Enhancing and protecting organizational value through quality assessment reviews

Enhancing and protecting organizational value through quality assessment reviews

Authored by Dan Buttke

Internal audit departments can contribute to the success of an organization and influence the effectiveness of its governance, risk management and internal control processes. To be the most impactful, the department’s operations should align with the strategies and objectives of the organization, have their efforts focused on the company’s highest risk areas, perform their services accurately and effectively, and clearly communicate the results and impact of their work. 

The company’s leadership and governing board will often explore whether their internal audit department is performing at its highest level by asking the question, “who’s auditing our internal auditors?” The answer to this question can be explained through a quality assessment review (QAR), which has the potential to accomplish both value enhancement and risk protection to the organization. Furthermore, implementing a quality QAR can serve as a key component to an internal audit’s strategic plan by positioning the internal audit function as a major contributor to the well-being of the organization.

Common challenges and opportunities

Internal auditors can overwhelm management with detailed reports. They may also focus on delivering coverage across the organization by using standard versus custom audit programs, placing emphasis on internal controls rather than risk, and shying away from the use of data analytics and technology. Internal auditors have an opportunity to clearly communicate the impact of their activities through regular touch points with senior leadership and the board of directors. To assess the effectiveness and value of an internal audit department, organizations should ask:

  • Is the internal audit function adding value to our organization? Have they struck a good balance between traditional assurance and advisory activities?
  • Are our internal audit activities aligned with the goals of the organization?
  • Is our internal audit function engaged and proactively involved in changes to help the organization manage risk more effectively and timely?
  • Are metrics in place to evaluate expectations? Are those metrics aligned to value or do they focus on completing a certain amount of audits?
  • Is the organization taking action because of internal audit’s work? Is this impact visible to leadership and the board?

Intention of the internal audit standards

Internal audit functions, and how they evaluate their standards, evolve over time. Because of this, the Institute of Internal Auditors (IIA) states, “While differences may affect the practice of internal auditing in each environment, conformance with the IIA’s International Standards for the Professional Practice of Internal Auditing (Standards) is essential in meeting the responsibilities of internal auditors and the internal audit activity.” Furthermore, the Standards’ intent is to:

  • Guide adherence with the mandatory elements of the International Professional Practices Framework
  • Provide a framework for performing and promoting a broad range of value-added internal auditing services
  • Establish the basis for the evaluation of internal audit performance
  • Foster improved organizational processes and operations

By conducting an effective QAR, the internal audit department is able to demonstrate to its stakeholders that it is performing work consistent with the professional practice of internal auditing. In addition, it gives stakeholders an opportunity to reflect and consider how internal audit can advance their services and increase value in support of the organization.

QAR requirements

If an internal audit function desires to communicate to their stakeholders that they perform their work in conformance with the Standards for the profession, they will need to have a QAR performed. QARs are addressed in Standard 1312 – External Assessments, which states that a qualified, independent assessor or assessment team from outside the organization conduct an external assessment of an internal audit activity at least once every five years. This can be accomplished through two types of external assessments:

  • Full external assessment: This method uses a qualified, independent team led by an audit expert. Team members should also be competent professionals who are knowledgeable in the Standards, assessment methodology and successful internal audit practices. The assessment team works on site at the location of the internal audit department, conducts interviews, benchmarks, and reviews work papers. The assessment team also drafts a report stating the internal audit department’s conformance or nonconformance to the Standards and providing any recommendations for improvement.
  • Self-assessment with independent validation: This method begins with the internal audit function performing a self-assessment of its compliance with the Standards. A competent independent evaluator who is knowledgeable in quality assessment methodology then comes in to validate the self-assessment. In addition to reviewing the self-assessment and substantiating the work done by the team, the evaluator makes an on-site visit, interviews leadership and issues a separate report. This approach may require more time for the internal team to perform the self-assessment, but it provides an excellent learning opportunity for the internal audit function. It can also be a less costly for an external assessor to validate rather than perform a full external assessment.

Moving beyond the Standards

Beyond simply stating that the internal audit function conducts its activities in accordance with the Standards, QARs can serve as an important input for the internal audit’s strategic plan. It is important to note that when conducting these assessments that the internal audit department may be performing their work in alignment with the Standards but may not be doing the right work and optimizing its value to the organization.

Staffing with specialized professionals

Competence of the external assessor or validator is demonstrated through a mixture of experience and theoretical learning. Because of these prerequisites, public accounting firms with industry and internal audit focus are often determined to be the most qualified to perform a QAR. By incorporating an external advisor into QAR assessments, organizations are able to receive a unique industry perspective about the risks affecting their organization through candid conversations from professionals that work with similar insurance organizations. A well-crafted report that outlines adherence to the Standards, accompanied with industry insights, can help management evaluate how internal audit can provide assurance and propel the organization to the next level.

For more information on this topic, or to learn how Baker Tilly specialists can help, contact our team.

Admissions office at college
Next up

Settling on college tuition in divorce – who pays?