Definition
An internal audit capability model (IACM) provides a framework for assessing the quality, impact, and cost-effectiveness of an internal audit activity. It also identifies the fundamentals needed for effective internal auditing and describes the levels and stages through which internal audit activity can develop and improve processes and practices. The Institute of Internal Auditors (IIA) produced an “Internal Audit Capability Model for the Public Sector” in 2009, for example, which can be used in public-sector organizations, and others are available, with some service providers producing IACMs.
The IIA model consists of five progressive capability levels, each describing the characteristics and capabilities of an internal audit activity at that level. Implementing repeatable and sustainable processes at one level provides the foundation on which to progress to the next. The levels are as follows.
Level 1. Initial. No sustainable, repeatable capabilities; dependent on individual efforts.
Level 2. Infrastructure. Sustainable and repeatable internal audit processes.
Level 3. Integrated. Internal audit and professional practices uniformly applied.
Level 4. Managed. Internal auditing integrates information from across the organization to improve governance and risk management.
Level 5. Optimizing. Internal auditing learns from inside and outside the organization for continuous improvement.
At Level 1, the least advanced, the internal audit infrastructure and its institutional capability are undeveloped. There may be isolated single audits, but the results are dependent on the skills of individuals. Internal auditing is ad hoc and unstructured. On reaching the most advanced level, the internal audit activity is a learning organization with continuous process improvements and innovation.
Advantages
-
An IACM can assist users to develop an internal audit strategic plan, as well as to develop an effective internal audit function.
-
The model can be used as a self-assessment and continuous improvement tool for internal audit activities by audit committees, senior management, and legislators to evaluate the need for and the type of internal audit activity appropriate to their organization or jurisdiction. The model could also be used by national, regional, and local legislative auditors as a source of benchmarks.
Disadvantages
-
As with any self-assessment process, the results obtained from the model are dependent on the supply of objective and accurate information.
-
An internal audit activity might, for example, assess itself at a higher capability level than actually applies because the participants are not fully aware of professional practices.
-
Implementing the model can be timeconsuming and costly, particularly for a small organization.
Action Checklist
-
Participants in the IACM need to understand the structure and underlying principles of the capability model.
-
The chief audit executive and the internal auditors must be committed to the exercise and its results, and should develop an action plan for improvement.
-
Management needs to support and clarify the purpose of using the IACM, explaining how it will improve the capability of staff members and the potentially positive implications for their career development.
Dos and Don’ts
Do
-
Ensure that the team includes at least one person skilled in conducting internal or external assessments of an internal audit activity and another person who has responsibility for making improvements to the activity.
-
When implementing the IACM, take into account organizational factors such as corporate governance, culture, internal control systems, and human resource capacities.
-
Communicate the results by identifying strengths and areas for improvement and by formulating an action plan for the development of internal auditing.
Don’t
-
Don’t ignore the fact that internal auditing capabilities cannot outpace the maturity of the organization that they support. To reach the higher levels will need advanced enterprise risk management strategies and practices.
www.qfinance.com