Some internal audit functions are using the disruption caused by COVID-19 to refocus their planned audit programs. In some cases, with the approval of the audit committee, Chief Audit Executives (CAEs) are using the time to improve their own internal processes and systems rather than continuing with planned audits.
One CAE at a federal government agency, says “COVID-19 has presented significant challenges to us as an organisation, and we have re-focused our agency’s activities to support some of the government’s COVID-19 support packages. A lot of staff are working from home, and some of our agency’s “business-as-usual" activities have been temporarily suspended. We have responded to this as an audit team by re-looking at the audits we had planned over the next few months. Speaking with our CEO and the Audit Committee Chair, we have agreed to delay several audits until next quarter to minimise further disruption to the business but have refocused our work in two areas. A number of our staff are providing consulting advice regarding the adequacy of controls around the COVID-19 support packages, while other staff are using the time to undertake some internal quality work that we had planned for next year.”
Whilst no one would wish for the impact caused by COVID-19, using the time effectively can help ensure the medium to long-term success of organisations. And in some cases, the unexpected chance to spend time on internal quality activities means that internal audit teams can help ensure the effective delivery of these programs.
For some internal audit functions, this ability to find some down time to focus on quality is a rare, but precious, opportunity. 29% of Chief Audit Executives (CAEs) surveyed as part of the Institute of Internal Auditors (IIA’s) CBOK study reported that their quality assurance and improvement program (QAIP) was “nonexistent or ad hoc”. An additional 37% stated that their program was “in the process of development”. These internal audit functions are missing the benefits of a robust QAIP, which include:
Facilitating continuous improvement of the internal audit function
Improving conformance to the Standards
Assessing internal audit performance
Benchmarking against peer organisations and better practice
Obtaining an independent perspective of internal audit’s work
Improving the efficiency and effectiveness of internal auditing
Enhances the value of internal audit services
Helps ensure internal audit’s success
Undertaking a periodic internal assessment or “health check” can make the most of any spare capacity within the internal audit function. This could examine the appropriateness and adequacy of policies and procedures, and the extent to which audit practices deliver value to the broader organisation.
Areas that the CAE may want to consider include:
Whether internal audit engagements are consistent with the internal audit charter and mandate
The extent to which the internal audit function is meeting management expectations
The value being delivered by the internal audit function
The level of effectiveness and efficiency within the internal audit function
How well the internal audit function is performing against its own policies and procedures
How well the internal audit function is performing against professional standards
Benchmarking against other similar organizations
Depending on the resources available, the health check could cover the entire internal audit function or may be limited to specific areas such as:
Conformance with engagement documentation policies through the selection of a sample of working papers
Conformance with IIA Standards
Assessment of training undertaken by internal audit staff and the extent to which this meets their professional development requirements
CAEs are responsible for maximising the value that internal audit provides to the broader organisation, and in times of crisis, it is especially important that each organisation has a high-quality internal audit function.
