Internal Audit Issues Analyzed - Institute of Internal Auditors conducts analysis of internal audit departments' quality assurance reviews - Brief Article

Internal Auditor, Oct, 2000 by C. Brune

A RECENT STUDY THAT examined 37 external quality assurance reviews (QARs) of internal audit departments reveals numerous similar cross-industry concerns and recommendations. The research was conducted by The IIA to help internal audit departments identify problem areas and improve the quality, efficiency, and effectiveness of their services. Results of the analysis point to recurring issues regarding risk assessment, policies, communication, time management, and internal audit staff development.

Compiled QAR documents reveal that risk assessments are frequently incomplete or not performed at all. Other common findings include illdefined audit universes and inadequate risk analyses of information technology issues.

According to the IIA research, internal audit departments often lack adequate, formerly approved control policies. In addition, several audit shops have been relying on outdated internal audit policies or charters.

IIA analysts also discovered communication deficiencies on a variety of levels. The studied QARs often included recommendations that practitioners market the internal audit function, seek feedback from customers, educate other departments about risk and internal control, keep management abreast of projects and issues, attend highlevel executive meetings, engage in strategic planning processes, and inform the audit committee on the status of audit plans.

Additional suggestions addressed the need to improve auditors' time management skills. The QARs specifically advised internal auditors to track their time by audit phase--planning, fieldwork, or reporting--and to analyze the productivity of annual audit plans and individual audits.

The study also shows that many organizations have failed to implement a formal plan to ensure continuing professional education for internal auditors. The QARs included repeated recommendations for additional training on fraud awareness, information systems auditing, and specific industry-related information. Those who conducted the quality reviews also advised chief audit executives to enhance their staffs' professional development by encouraging job rotation, identifying career paths, and providing more timely performance evaluations.