The Institute of Internal Auditors (IIA) requires an External Quality Assessment Review (EQAR) at least every five years for the Internal Audit Activity (IAA). As part of the review, assessors examine the internal audit activity and evaluate their conformance with the IIA standards. Additionally, areas of success and opportunities for performance enhancement are identified. When working with clients, we’ve found it most helpful to break down the performance evaluation into the following distinct areas: planning, people, metrics, and tools. Upon doing so, we’ve gathered several noteworthy observations for each performance area. Today’s area of focus is people.
People Observations
The essential resource for an IAA is people. An IAA can have best-in-class audit software, a clear audit methodology, effective QAIP, and comply with the IIA standards. However, it can not function without the right people. There are three areas for an IAA to consider:
1) Insufficient Talent Strategy Plan
In our QARs performed over the years, we have found that a quarter of QAR results did not address recruiting, retention, and replacement. A Talent Strategy Plan should consider the specific skills that key stakeholders expect, now and in the future, and often analytical and critical thinking skills, communication skills, IT knowledge and expertise, business acumen, and data analysis.
Therefore, the following questions may help:
- Do you have a talent strategy plan that aligns with your key stakeholder expectations and identifies skills gaps you may have in your IAA? Is the plan aligned with your IAA strategic goals, mission, and vision?
- Do you survey your team to identify staff morale and areas of improvement to retain and develop the team?
- Is there a clear path for promotion and performance guidelines for each level? Do you have recent examples of internal promotion that provide examples of rewarding positive performance?
2) Inadequate Training and Credentials
In our review of QARs, we have seen many examples of inadequate training for an IAA. For instance, we have seen some IAAs with no training, “free” training only, limits on hours of training available, and misalignment with the training obtained and the team member’s development plan. Instead, an IAA should provide training that meets standard benchmarks of 40 to 60 hours a year and align with the development paths for both the individual and future projects.
The following questions may help:
- Is your training plan designated to address skills gaps and key stakeholder expectations now and in the future?
- Do you receive sufficient internal financial support for training, and should efforts be made to increase this budget area to provide greater value to the organization?
- Do you provide incentives in the form of rewards, financial rewards, or time-off to motivate the team to achieve certifications?
3) Co-sourcing Expertise
We have observed work delegated to staff based on what needs to be done rather than what is within the staff’s abilities and scope. Solely focusing on what needs to be done versus staff ability can harm the quality and meaningfulness of a particular audit, leading to a declining value of the IAA to your organization.
Outside resources with specific areas of expertise can release the burden on staff completing tasks beyond their knowledge or experience and give them time to focus on what they do best. In our review of QARs, we see over 50% of organizations use third parties, which can be the key to success and credibility for the IAA.
The following questions may help:
- Do you consider using third-party audit assistance when designing your annual audit plan?
- What challenges make it difficult to use third-party audit specialists or assistance?
- What areas in your annual audit plan would benefit from third-party assistance?
- Are there some areas where a third party would provide greater value and credibility to your audit results?
How MorganFranklin Can Help
We work with our clients to provide an independent validation of the Internal Audit Activity and identification of opportunities to increase effectiveness, improve processes, and enhance credibility. Our methodology is built around complete support and encompasses benchmarking, best practices, templates, and tools to support business goals. To learn more about MorganFranklin’s EQAR, contact our experts below.
