Comments from ACCA to the Institute of Internal Auditor, January 2010.
ACCA has been actively involved in public sector financial management and corporate governance issues over a number of years and we warmly welcome the opportunity to respond to the above consultation.
Internal audit for government departments within the UK is already one of the most developed internal audit functions internationally. However, for the reasons clearly set out in your consultation we agree that a review of internal audit both is timely and will help it to cope with future challenges.
An internal audit strategy aligned to departmental, cross-cutting and other relevant strategic objectives will maximise the impact of internal audit and enable a more efficient and effective assurance to be delivered to accounting officers and other senior stakeholders?
ACCA supports your proposal to have an internal strategy which is aligned to departmental, cross-cutting and other relevant strategic objectives. It is important for a number of reasons, not least that it will provide a clear statement on the risks that need to be prioritised, how internal audit assesses coverage, the resources to achieve coverage and standards to be adhered to. In addition, it will be an important document for distinguishing internal audit from external audit and will help promote increased transparency and accountability across government departments.
The Institute of Internal Auditor's (IIA) 'Internal Audit Capability Model' for public bodies provides a useful framework for helping to shape and develop an internal audit strategic plan, as well as developing an effective internal audit function. In our view a well managed internal audit function would be characterised as having a strategic plan that demonstrates how internal audit would gain overall assurance on governance, risk management and internal controls, how it intends to meet professional practices, manage performance, manage its people, develop organisational relationships and clearly set out its independence, power and authority. It should also set out how it proposes to benchmark its performance against other similar internal audit functions.
We are in agreement that that there should be consultation on internal audit's strategic plan with all key internal and external stakeholders, such as the NAO. The latter is important because of potential changes arising from a review of the way current external audit services are provided. The strategic plan should also be dynamic, perhaps looking ahead - three to five years. It should highlight projections of intended audit coverage to ensure all areas of risk are covered over a given period. As far back as 1995 the Audit Commission found in its review of local authorities internal audit functions that the best local authorities had such a strategic plan in place. An effective strategic plan also enables external audit to gain increased assurance about the coverage and quality of internal audit work.
In determining internal audit's strategic plan it is also important to consider the influence that corporate governance structures, risk management and control frameworks operating across government will have on the ability to implement the strategic internal audit plan. We believe that having an effective internal audit function is key to good governance and should be given prominence in any proposed changes to governance structures and frameworks.
The need for better accounting officer, audit committee chair and other senior stakeholders engagement in the mapping of strategic objectives, risks and sources of assurance to improve the cost-effectiveness of overall assurance arrangements and enhance the role of internal audit
We agree that key stakeholders should be engaged at the strategic planning stage. Not least because that would ensure comprehensive internal audit coverage, but also that it will help to manage expectations and will gain the support of the accounting officer and audit committee chair. Now more than ever the relationship between the audit committee and internal audit is critical as the revised combined code and the emphasis on corporate governance has placed internal audit centre stage.
A well resourced and supported internal audit strategy and function is necessary for effective governance. As the IIA describes in its paper 'A view from the audit committee' it is one of the four cornerstones of effective governance, together with the board, executive management and external audit. Better engagement between all four will mean that will mean that internal audit's strategic plan will cover all aspects/ issues which really matter to the government department concerned.
The fundamental proposal in the strategic improvement plan is that a group internal audit service will enable internal audit resources to be used more efficiently and effectively? Do you agree and, if not, please state your reasons and any alternatives.
In our view an effective internal audit function will provide assurance to the board that in key risk areas standards and policies are in place and are being implemented effectively. In addition, it will provide sufficient audit coverage to minimise the potential for financial loss. To achieve this internal audit must plan and ensure that appropriate resources are employed and individual audits add value. Above all, any structural change must be capable of addressing key areas of risk.
Generally, the provision of internal audit varies greatly across OECD countries and in sectors of public services e.g. local government. Some are centralised, others decentralised and/or outsourced functions. The costs and benefits of such models should, if they haven't been already, be evaluated against the proposed new structure before a final decision is made.
Whilst in our view a group internal audit service has the potential to provide many benefits such as increased flexibility in the use of resources, an ability to employ a better staff mix people and skills it must be underpinned by a firm understanding of risks, the volume of audit work, types of audit work to be undertaken and the skills needed to be employed. Attention should also be paid to key indicators of internal audit's efficiency and effectiveness, such as whether the group structure ensures the most optimum staff utilisation rates and skills mix.
Comment on the proposal that the larger critical masses of internal auditors provided by group internal audit services will enable resources, including the use of co-sourcing, to be used more flexibly and improve skills and career development opportunities, including identifying and developing the leaders of the future? Please state any alternatives that you would suggest to achieve the intended improvements in quality, impact and cost effectiveness, including possible outsourcing arrangements.
As stated above, the proposed group structure has the potential to make a better use of internal audit resources. As reported by the Audit Commission there is evidence to suggest that internal audit staff that are not organised into fixed teams either on a client basis or for a particular group of audit clients gives much more flexibility in the deployment of resources. For example, auditors can be drawn from a pool from which they are allocated to projects according to demands and suitability of individual auditors. Similarly, it would be helpful in indentifying those projects suitable for co-resourcing.
As set out by the IIA the most effective internal audit functions are committed to management development, promoting leadership, team building and skills development. The Internal Audit Capability Model (IA-CM) is a useful framework for assessing the quality, impact and cost effectiveness of the proposed internal audit function. In our view the likely benefits of the proposed larger teams are that they will provide staff with greater opportunities to develop in new audit specialist skills and gain experience from auditing a wider range of clients. The structure can also support a better cross-fertilisation of skills and learning together with driving up professional standards, as well as providing sufficient flexibility to ensure that experienced staff can be redeployed quickly in the event of an emerging issue.
However, we fully accept that there are benefits to be had from other models, including the potential out sourcing of internal audit services. We have no firm views on whether a fully out sourced internal audit service would be more efficient and/or effective. But we are strongly of the view that any proposed changes must support a more commercially and customer orientated internal audit function. The total cost of internal audit and average cost per audit day (utilisation) are important measures of cost effectiveness of an internal audit function together with qualitative measures on the level of quality and performance. Overall, an internal audit function which compares favourably to other internal audit services against these types of benchmarks will deliver value for money.
Please comment on the role we propose for the head of the government internal audit profession and whether you agree that it will improve the quality and consistency of internal audit services and attract high calibre entrants to the IA service. If you do agree, please state your reasons and any alternative approaches that you would suggest.
We believe that the head of the government internal audit profession has a key role to play in setting the strategic direction of internal audit across government. As a figurehead he should seek to be recognised as a key agent for change. As well as being an advocate for internal audit, his key responsibilities are to build effective relationships with principal accounting officers and chairs of audit committees whilst maintaining independence, power and authority over internal audit activities. This would require an enhanced role.
As a final point, while the head of internal audit will have a valuable role to play in overseeing standards and consistency, the proposed enhanced role will not on its own be sufficient to attract high calibre candidates. There is no doubt that it will help, but what is more important for attracting high calibre candidates is career development and progression opportunities and the desire to be part of a high performing internal audit service.