October 2011

 

A robust engagement supervision program can help ensure quality internal audit services.

Chris Dogas, CPA, CFE
Internal Audit
Novartis Corp.

While reviewing a draft audit report, a chief audit executive (CAE) decides to refer to the audit workpapers to better understand an audit matter when he realizes that the audit observation lacks validity. The audit team did not apply audit procedures correctly and, as a result, incorrect conclusions were reached. Further review of the workpapers reveals that additional audit work was not performed to assess key significant risks that were identified in the audit planning document. The client is expecting a closing meeting and draft report, and time is running out. Because of this failure, internal audit is unable to issue the audit report on time and will incur additional costs to perform the omitted audit procedures. While the example is hypothetical, it creates more than a headache for auditors. Receiving an audit report with an incorrect conclusion may cause the audit committee to question the effectiveness of the internal audit function, and internal audit may lose credibility and the respect of senior management and stakeholders. Moreover, the internal audit team may begin to question its own judgment and its ability to deliver quality audit services.

The IIA provides clear rules on engagement supervision for internal audit via the International Standards for the Professional Practice of Internal Auditing. Standard 2340: Engagement Supervision states that internal audit “engagements must be properly supervised to ensure objectives are achieved, quality is assured, and staff is developed.” The standard makes the CAE ultimately responsible for engagement supervision, the extent of which depends on the proficiency and experience of the audit team. Practice Advisory 2340-1: Engagement Supervision recommends appropriate supervision during audit planning and execution and states that supervision helps ensure that the audit team possesses knowledge, skills, and competencies required to perform the audit. Effective supervision minimizes the risk of making incorrect or inconsistent professional judgments that may impact the engagement negatively. Because of the association between engagement supervision and quality of service, the audit community needs to have an effective system of checks and balances during fieldwork to help ensure that individual observations are valid and documented well in workpapers; address possibly deficient supervision in the increasingly used rotational, outsourcing, and cosourcing models; and strike the right balance between audit supervision and engagement efficiency.

ROOM TO IMPROVE

In The IIA’s 2010 Global Internal Audit Survey, 2,940 CAEs reported that engagement supervision and reporting audit issues adequately in workpapers continue to be key areas needing improvement. The survey provides evidence that engagement supervision in internal audit is generally below desired levels and that mandatory IIA standards are not followed. Internal and external auditors alike recognize the need for adequate, robust engagement supervision, especially in light of recent historic corporate failures and the changing economic conditions that have affected corporate internal audit. While internal auditors follow audit programs to complete audit assignments, they use individual knowledge and experiences to make decisions and judgments that have a direct impact on audit observations and opinions. Engagement supervision is paramount in auditing because it provides the construct to reasonably assure that audits are carried out as planned, with sufficient professional skepticism, objectivity, and a high degree of quality.

One reason internal audit historically has struggled with engagement supervision is due to departments often not being sized correctly or organized adequately because of downsized budgets and cost-cutting measures over the last several years. Internal audit functions have reduced or eliminated layers of management positions that have left them without vertical differentiation in levels of authority and responsibility, except for the CAE. Internal audit functions without vertical differentiation are unable to provide effective engagement supervision because they do not have experienced and trained managers on staff to supervise engagements effectively.

Rotational auditing and internal audit outsourcing or cosourcing are organizational models that carry additional risk of deficient supervision. The October 2009 Knowledge Alert from The IIA’s Audit Executive Center, “Recent Impacts on the Staffing and Sourcing of North American Audit Activities,” points out that about one-third of the U.S. Fortune 500 companies’ internal audit functions use the rotational model. Other research indicates that about one-third of internal audit functions are outsourced or cosourced.

Rotational Model
Popular among large corporations, the rotational model gives internal audit a renewed purpose — that of supplier of the talent pipeline. Conceptually, the rotational model is a win-win situation. Internal audit provides assurance to the board while the organization benefits from receiving future leaders, groomed and trained through a series of challenging internal audits. In reality, the model does not always work as intended. Critics point out that while rotated auditors bring fresh ideas and experiences to work, there are questions about their objectivity and effectiveness. Because rotators are hired for a short tenure, usually two to three years, and their career objective is to transfer out to the business, there is concern about the effectiveness of their work due to bias. Could they be more allegiant to management and less objective as they try to secure a position in the business while they conduct internal audits? There also are concerns about the rotators’ audit experience and institutional knowledge in the field of internal auditing. PricewaterhouseCoopers’ (PwC’s) 2010 State of the Internal Audit Profession survey notes that for the rotational model to work well, it is assumed that an “in-house coach with the required expertise exists within the organization, which is often not the case, and constitutes a challenge for many organizations.” Supervision is required to balance out the shortcomings of the model, however, when the organization is non-hierarchical, provided supervision is not possible.

Outsourcing and Cosourcing
Well-suited for mid-sized and small organizations, outsourcing and cosourcing have benefits that are well known: Lower operating costs, increased efficiencies, and acquired internal audit expertise in methodology and audit techniques from consultants. But they have risks, too, most significant of which is loss of control. Losing control in audit engagements could mean uncertainty regarding whether the engagement is staffed appropriately, managed well, and supervised effectively.

HIRING AND RETENTION

Engagement supervision can provide tremendous opportunities to improve the internal audit function. Hiring internal auditors with the right mix of skill sets, measuring their performance, and providing continuous development opportunities to improve their knowledge of the business, experience, and credentials have been identified as key components of internal audit management. Engagement supervision provides a firsthand opportunity to learn from direct interaction with teams and individuals, and to obtain direct input regarding audit quality and performance. Management can assess whether the audit teams work effectively, the audit methodology used by the function is sound, expected leadership skills and abilities are present, and the team works well together. Many of the must-have skill sets identified by the profession are best assessed through direct observation during fieldwork, including critical thinking and analysis, communication, and use of technology. Learning from these sessions also can identify future training and development topics that need to be provided.

The Job Characteristics Theory, one of the most influential theories in organizational psychology developed by Richard Hackman and Greg Oldham almost 20 years ago, found that employees value and expect on-the-job feedback. Working in the field with the audit team provides a perfect venue to interact and provide such feedback. Generally, the more on-the-job quality feedback one receives, the more likely he or she is to be engaged, continue learning and improving, and continue to perform quality work.

ACQUIRE KNOWLEDGE

Intelligence obtained from audit supervision about audit quality, professionals’ competence, judgment skills, performance, strengths, and weaknesses can be cataloged and incorporated in the audit function’s competency model, which can facilitate future recruiting needs and selection criteria that will aid in hiring decisions. This intelligence also can be used to update the internal audit methodology to improve the audit process. Moreover, CAEs can use the intelligence to benchmark the internal audit function against peers in their organization’s industry and provide the audit committee with reliable feedback about the quality of the function and its activities. The audit committee will welcome this type of feedback, as it is charged with periodically assessing whether the internal audit function is equipped to deliver quality services.

BALANCE IT OUT

Striking the right balance between audit supervision and productivity is challenging but of utmost importance. Excessive, unnecessary supervision can lead to micromanagement and negatively affect employee morale. It also can be expensive. The challenge is not to create unnecessary processes and rules that slow down the audit process or further erode the quality of audit services. Excessive supervision or unnecessary criticism also can cause conflict and demotivate internal audit. Providing audit managers and auditors with high-quality training and coaching on how to give, receive, and process effective and constructive feedback and how to perform workpaper reviews, including sensitivity training, can adequately counterbalance the risks.

Effective internal audit engagement supervision should be at the forefront of audit work if internal audit is committed to capitalizing on the recent historic opportunity to further legitimize and elevate the status of the profession. Adequate supervision is not just mandatory to comply with IIA standards; it also will help ensure that internal audit provides quality assurance to the audit committee, management, and external auditors — those who rely on its work the most.

 

Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online, or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to edit/remove comments.

Name:

Email:

Subject:

Comment:

---

To make something bold:
<strong>Text to bold</strong>

To make something italic:
<em>Text to italicize</em>

To make a hyperlink:
<a href="URL">Text to link</a>

---