Maintaining control: will a boom in internal auditing result in a bust in audit quality?

Internal Auditor, Feb, 2005 by Norman Marks

This is an interesting opportunity for The IIA. As business leaders, chief audit executives (CAEs) are responsible for ensuring internal audit services are not only of high quality, but are a good value. Now would be a good time for an IIA Practice Advisory guiding CAEs on how to build staffing models, taking into account both the cost and value of alternate staffing strategies. For example, how much and which services should be kept in-house versus being outsourced? Is it practical to move the entire, or at least a major part of, the internal audit staff offshore to take advantage of lower staffing costs?

DILUTION OF THE PROFESSION I have been a consistent user of co-sourced internal audit services, but I am becoming concerned that the CPA firms providing those services may not be playing by the same rules as practitioners. The contracts that the larger CPA firms are asking practitioners to sign do not indicate that their internal audit services are compliant with The IIA's International Standards for the Professional Practice of Internal Auditing (Standards). Instead, they state that their services are in accordance with American Institute of Certified Public Accountants (AICPA) consulting standards. The CPA firms are reluctant to present opinions on the adequacy of the internal controls addressed in their audits, because that is inconsistent with the consulting standards.

This presents problems. First, the practitioner must understand what he or she will be getting. Although the chief executive officer and chief financial officer--and the progressive CAE--must provide an opinion on internal controls, the co-sourced internal audit provider is often reluctant to do so. The co-sourcer will report control deficiencies, but will rarely express an opinion as to whether the controls are adequate. That should be of concern if the practitioner is asking a partner firm to perform internal controls testing for Section 404.

The audit committee and executive management of organizations outsourcing internal auditing to one of the large CPA firms should think twice before allowing those organizations to avoid expressing an opinion on internal controls. It is increasingly common and good practice for an internal CAE to provide the board and executive management with assurance on internal controls by giving his or her opinion on their adequacy. It is unsatisfactory for an outsourced provider to do any less.

The IIA should be very concerned. How can The Institute profess to be the standards providers and leaders when such a large and growing percentage of internal audit practitioners profess to be following the AICPA's standards and not The IIA's? Now is the time for action, before it is too late to change minds as well as practices.

Although The IIA's strategic plan includes an advocacy initiative for 2005 that addresses some of these issues, in my opinion, The Institute must make the following a priority this year:

* Set a goal that by the end of 2005 the AICPA will recognize The IIA's Standards as applicable to all internal audit services provided by its member firms.