Audit & Risk

Models of effective internal audit – how should you organise your internal audit function?

A new report from the IIA looking at six main delivery models for internal audit outlines the advantages and challenges of each, explains David Lyscom, IIA policy director.

in Policy Blog.

We are often asked for advice about setting up a new internal audit function, or indeed about revamping an existing one. Is there a best practice way of managing internal audit for particular types of organisation?

In response the institute’s Policy and Technical Team has done some research on the different models and published it on our website. In our report, Models of internal audit, we look at six main delivery models and outline the advantages and challenges of each.
We use practical case studies based on interviews with the heads of internal audit at TfL, BT Group, Mid-Kent Internal Audit Partnership, the Irish Department for Public Expenditure and Reform, the University Internal Audit Consortium, the Mersey Internal Audit Agency, the Civil Aviation Authority and Baker Tilley.

So, which is the best model?

Unsurprisingly our conclusion is horses for courses. There is no right or wrong way to deliver internal audit. Organisations need to be free to choose what works for them according to the nature of what they do, how the organisation is structured, the way processes operate, their financial circumstances and the risks to their strategic objectives. We hope that the menu of options on offer in our paper will help organisations to ask the right questions about their needs, and decide what will work for them.

We were, however, able to draw some general conclusions from the research. The first is that organisations care about and value internal audit. They spend valuable time considering how to develop and improve their own particular models. This is not just about keeping costs down, although that is important. It is about maximising the efficiency and effectiveness of professional practice – choosing a model that offers objective opinions, assurance and a range of experience and skills that positively impacts the way the organisation delivers success. The research also reveals that the profile of internal audit is being raised, creating higher expectations, new pressures and competition, and that it would not be surprising if new models were to emerge in future.

We identified a number of the common attributes emerging from the study that can be used to measure success in any service delivery model of internal audit operation, such as a structure that promotes independence and objectivity, knowledge of the organisation, its markets and risks, and expertise in areas such as IT and contracts.
So how you structure your internal audit does not appear to be as important as how it is able to operate and what it does in practice. Again, this is not a surprising conclusion as it is the global standards that count, not how you apply them in detail.

I hope you find the report useful, both in looking at your own function, but also in your discussions with stakeholders, especially audit committees, about how your operation compares with others and what reform or fine tuning could bring in practice.

The IIA: find out more

Visit the main IIA site

Jobs

Auditor

Post Number: FSA02
Grade: 7- SO2 Salary: £23,166 - £29,854
Hours: 37 per week

Audit Manager

£38,789 - £42,474 pa
37 hpw, permanent.

Senior Internal Auditor

Sector: Not For Profit
Salary: £41,000 (raising to £46,000 after probation)
Location: London
Job Ref: SD/148943

Careers advice

Destination designation

The Chartered IIA is keen to work with organisations that want to ensure all their internal auditors have the right skills to succeed in today’s industry. One of these is Citigroup, which recently launched a training scheme accredited by the institute and put 20 senior internal auditors through the Chartered by Experience route to achieve CMIIA. So what does this look like in practice?
Words: Ruth Prickett

Gold standard – the value of recognition

Being chartered demonstrates your skills and competence and gives you influence within both your organisation and the wider profession. All dedicated internal auditors should aspire to it, writes Ian Peters, chief executive of the IIA.

Chartered by Experience

There is a new route to becoming a chartered internal auditor: Chartered by Experience.

Training & Development

CPE: Solid foundations

Continuing professional education is an important tool for developing your skills, progressing through your career and ensuring that the qualification and the profession are respected. The Chartered IIA’s CPE requirements will be changing in April to bring them into line with those of IIA Global. So what do you need to know to stay ahead?
Words: Ruth Prickett

Destination designation

The Chartered IIA is keen to work with organisations that want to ensure all their internal auditors have the right skills to succeed in today’s industry. One of these is Citigroup, which recently launched a training scheme accredited by the institute and put 20 senior internal auditors through the Chartered by Experience route to achieve CMIIA. So what does this look like in practice?
Words: Ruth Prickett

Gold standard – the value of recognition

Being chartered demonstrates your skills and competence and gives you influence within both your organisation and the wider profession. All dedicated internal auditors should aspire to it, writes Ian Peters, chief executive of the IIA.

Tools

You asked us

Our technical helpline provides valuable advice to members on a host of professional issues. Here are some of the questions you’ve recently asked.

Early warning systems

New regulatory demands for whistleblowing – or “speak up” – policies are raising the bar on best practice. Internal auditors need to take note.
Words: Alexander Glebovskiy

CPE: Solid foundations

Continuing professional education is an important tool for developing your skills, progressing through your career and ensuring that the qualification and the profession are respected. The Chartered IIA’s CPE requirements will be changing in April to bring them into line with those of IIA Global. So what do you need to know to stay ahead?
Words: Ruth Prickett