Learning to love the scrutiny: initiating a quality assessment can help an internal audit group come out on top

Internal Auditor, Feb, 2004 by Michael P. Fabrizius, Richard M. Serafini

MANY INTERNAL AUDIT DIRECTORS HAVE MIXED EMOTIONS ABOUT conducting an independent quality assessment (QA) (formerly known as a quality assurance review) once every five years, as mandated by The IIA's International Standards for the Professional Practice of Internal Auditing (Standards). Although they love the idea of raising the bar on quality--especially since the U.S. Sarbanes-Oxley Act of 2002 upped the stakes--they often loathe the idea of inflicting a QA upon themselves. * So, why did the internal audit department at Bon Secours Health System, based in Marriottsville, Md., welcome the scrutiny of a QA even before it was a requirement of the Standards? No one had been questioning the department's practices. There were no burning issues or concerns regarding quality. Still, the internal auditors were determined to take a proactive approach and complete an independent review of the department. The QA became a catalyst to reinforce and strengthen the department's position within the organization. It also offered access to professional best practices that would help ensure that the department was state-of-the-art.

The QA process turned out to be empowering and surprisingly painless. The experience has strengthened the internal audit program and helped raise the department's profile throughout the entire organization.

STARTING FROM WITHIN

Preparation, communication, and a positive attitude are the secrets of an enriching QA. At Bon Secours, preparations began with the decision to first include an internally conducted QA of the departmental objectives. The self-assessment helped prepare for and ultimately get the most value from an externally conducted QA.

A formal internal review is not always necessary before undergoing an external QA. In some cases, the results of the external review are needed to provide the framework for an ongoing quality control program that gets implemented internally. The key is doing what it takes to be prepared and to make the process as effective as possible.

Bon Secours' preparation included educating senior management and the audit committee on the concept of a QA, which in turn helped justify the time and effort involved with conducting an internal review and the expense of doing an external review. Additionally, three managers from the internal audit department attended The IIA's QA training courses to obtain the necessary skills and resources to optimize process effectiveness.

The internal review helped clarify the nuances of a QA and the multiple objectives that could be achieved. It revealed that, in addition to assessing technical compliance with the Standards, a QA would provide important information on benchmarking and best practices.

When the time came for the external review, the internal audit department, management, and the board knew exactly what to expect. Perhaps more importantly, the internal audit team faced the process with confidence. Everyone was hungry for a fresh perspective, rather than fearing what the QA might reveal.

INVOLVING SENIOR MANAGEMENT

Upon launching the external review, Bon Secours formed a QA oversight committee that included the chief financial officer, chief legal officer, and a member of the audit committee. Having total buy-in and direct involvement from these players was critical to the project's success. The appropriate people to involve in an oversight committee will vary from company to company, depending on the culture and the way management is organized. However, any company planning a QA should universally apply the concept.

The oversight committee helped develop the objectives for the review, the request for proposal (RFP), and the project timeline (see "Internal Audit Services QA Objectives and Schedule, page 41), and also assisted with selecting the service provider. The committee's involvement and oversight continued during the QA process and through the final report to the audit committee.

The oversight committee provided much more than a "rubber stamp." The committee's advice and counsel during the QA was invaluable. Its interactions with the service provider also gave executives increased respect for the internal audit function.

SELECTING A PROVIDER

Bon Secours issued formal RFPs to four providers. Based on a model provided by The IIA, the RFP was a critical document in communicating expectations to potential service providers (see "Sample Request for Proposal," page 42).

Each provider had an opportunity to learn as much as possible about the company and the internal audit function through the Bon Secours annual internal audit plan, which was an attachment to the RFP. The plan is a comprehensive document that includes internal auditing's scheduled audits, charter, organizational chart, annual budget, and staff background and credentials. Providing this level of detail ensured that all proposals were well-founded.

From the proposals the oversight committee received, it narrowed the field and interviewed two firms. One outlier was eliminated based on price. Another firm seemed more interested in promoting its marketing concept for a review rather than providing the fundamentals of what was needed. The committee ultimately selected Deloitte to conduct the QA, based on the firm's qualities and experience.