APPLYING RESEARCH FOR EFFECTIVE INTERNAL AUDITING

Chief audit executives can use the Internal Audit Capability Model to drive an internal audit strategy.

As U.S. Sarbanes-Oxley Act of 2002 efforts and focus decline and organizations have renewed their interest in risk oversight and have rediscovered operational risk, it is not uncommon for audit committees to expect more from internal auditing. It often is unrealistic, however, for chief audit executives (CAEs) to rely on the audit committee to define specific boundaries of what they want. Rather, the audit committee expects the CAE to provide the goals as well as the options and process to achieve them.  

At this stage, the IA-CM becomes extremely helpful as both an assessment and a visioning tool.

It is important to first examine the overall perception of where the internal audit department stands. While a quality assessment helps evaluate the fundamentals of the internal audit attributes and performance, the IA-CM enables CAEs to perform a strategic assessment of the internal audit capability, which then can be narrowed to more tactical attributes and performance issues.  

A seasoned CAE will not take long to assess his or her department based on the various criteria and categories used in the IA-CM, as well as by answering a series of easy questions:

• What services are being offered?
• What is the structure, skill, and competence mix of the team?
• How much is the internal audit department seen as a talent developer for the organization?
• How professional or methodological are the internal audit processes?
• How qualitative is internal auditing and how is quality measured (e.g., output only or outcome driven)?
• What is internal auditing’s role within the organization and at the governance table?
• How independent is the internal audit department?

 As demonstrated by the Internal Audit Capability/Maturity Assessment table, the visual of the assessment can be compelling and is easy to present to the audit committee.

Visioning Tool  
Audit committees appreciate a clear understanding and vision of the state of the internal audit function. The IA-CM provides a discussion framework for allowing the audit committee to select the level at which to operate with a clear understanding of the limitations each level offers. The IA-CM also can help assemble the roadmap to be agreed upon by the responsible parties.  

The Internal Audit Capability/Maturity Projection table demonstrates a plan to move to Level 5 (Optimizing) in three to four years where the priority in 2010 is to fill the gap at Level 3 (Integrated) and to get to Level 4 (Managed) in terms of performance management and accountability. From there, it is much easier to develop coordinated tactics in each of the categories with a clear understating about how they will impact and improve the overall department, as demonstrated by the 2010 Priorities table.

The Internal Audit Capability Model is a useful tool to measure the maturity of an internal audit activity in a broad range of organizations. For more information and to obtain a copy, go to The IIA Research Foundation website.

Internal Audit Capability Model for the Public Sector, copyright 2009 The Institute of Internal Auditors Research Foundation. Reprinted with permission.

The Institute of Internal Auditors Research Foundation based the structure of this model, in part, on “CMMI® for Development, Version 1.2,” CMU/SEI-2006-TR-008, copyright 2006 Carnegie Mellon University, with special permission from the Software Engineering Institute. CMMI is a registered trademark of Carnegie Mellon University.