Establish the authority of the internal audit activity and review the new definition of internal auditing and the International Standards for the Professional Practice of Internal Auditing (Standards) to become familiar with what is required. The attached PowerPoint presentation should help you in any discussions with management and the audit committee.

Interview senior management and board of directors/audit committee chairmen to build rapport, to ensure those at the top have a clear picture of the internal audit function, and to clarify expectations of all. Use this opportunity to quickly learn and address what management and the board view as the greatest risks to the organization, while keeping in mind issues, problems, and opportunities that have already been identified. Develop a system for cataloging such information, including date and name of person interviewed for quick reference in the future. There are many considerations that should be evaluated in determining the optimal structure and source for internal auditing resources. Those responsible for making such determinations should evaluate the additional guidance and considerations outlined in The IIA position paper "Resourcing Alternatives in the Internal Audit Function" (PDF, 93KB).

Obtain and review the audit committee charter. Of course, no sample charter encompasses all activities that might be appropriate to a particular audit committee, nor will all activities identified in a sample charter be relevant to every committee. Accordingly, this charter must be tailored to each committee's needs and governing rules.

Understand "benchmarking" needs, i.e., industry, specialty groups, organizations with same staff size, etc. Ask senior management who they consider to be leaders and laggards in your organization's market niche. Check out IIA's GAIN services. Review past GAIN surveys.

Obtain and review your organization's written policies and procedures, especially the policy pertaining to management's responsibility to control the organization.

Discuss with external auditors open and closed internal control issues, which they may have identified during their reviews.

Start to develop the "audit universe," or the list of all auditable entities.

Map the major processes/operations within the organization. Meet with operations managers, including those in information technology, in order to understand their risks and concerns.

Develop a risk assessment for your organization. This should be a macro-level assessment, which includes both external and internal risk factors.

Develop a charter for Internal Audit. Ensure that both senior management and the audit committee review and approve the charter. Information on audit charters can be found within the Professional Practices Framework or Establishing an Internal Audit Activity Manual. Additional samples are provided below.

Build the budget, including personnel and travel.

Based on your risk assessment, develop an auditplan. The amount of the plan that can be accomplished in the allotted time period (usually a year) will depend on the risks identified and the internal audit resources and staff. You should always leave time in your audit plan for management requests (usually 10 percent).

Hire your staff and develop a plan for staff training. Ensure your staff covers the range of expertise needed based on your risk assessment. You may also consider outsourcing portions of your audit plan to outside service providers or using professionals internal to the organization. Additional information is available within The IIA's Resourcing Alternatives for the Internal Audit Function.

Ensure that senior management notifies other departments of your existence and calls for complete cooperation. (The IIA has complimentary brochures, such as "All in a Day's Work," "Adding Value Across the Board", and "Guidance for the Profession".) Become familiar with The IIA's Web site and use the search feature on its home page to help you identify valuable resources.

Work with management to establish best-practice reporting relationships, to ensure internal audit is promoted throughout the organization, and to develop a methodology for following up on audit recommendations and measuring performance .

Step 16:

Establish a quality assurance program.

Sample Charters:

• Audit Committee Charter (PDF17 KB)
• Model Audit Committee Charter
• Model Internal Audit Activity Charter

Model Management Control Policy
Model Quality Assurance and Improvement Program

Internal Auditing: In Your Best Interests, Tone at the Top, October 2002

Professional Practices Framework

Ethics Repository

Governance Repository

Tone at the Top (Archives)

Audit Career Center

CAE Services Program

Certified Internal Auditor® (CIA) program

Global Audit Information Network (GAIN)

Quality Assurance Reviews

Strategies for Managing the Small Audit Shop

Tools and Techniques for Beginning Auditors

Vision University Seminar

This section is a resource site of The Institute of Internal Auditors, Inc. and is based on The IIA's many years of experience as the profession's recognized authority and acknowledged leader. For additional information about establishing an internal audit shop or contributing to this Web page, e-mail newauditshop@theiia.org