Newsletter Q&A

The IIA–Australia issues an e-mail newsletter every fortnight. Newsletter Q&A is a feature in conjunction with our ‘IAassist ask a question’ service. Newsletter Q&A seeks to provide insights to issues that affect many Internal Auditors. Members are welcome to send questions to IAassist@iia.org.au

Please see below list of questions answered in previous newsletters:

AGILE INTERNAL AUDITING

A lot of people seem to be talking about agile internal auditing. What does this mean?

With the pandemic crisis currently happening, I asked the head of internal audit if perhaps our internal audit function should take some time off from the audits we are doing in line with the approved internal audit plan and use the time to help out our organisation in any area where help might be needed. What do you think?

INTERNAL AUDIT SERVICES  
I am seeking advice about the scope of internal audit services and whether internal auditors can provide expert services beyond ‘traditional audits’.

OUTSOURCED INTERNAL AUDIT
My organisation’s internal audit service is completely outsourced to a service provider firm. Would they also provide ‘advisory services’?

What is the position when internal audit engagements are performed by external service provider firms?

INTERNAL AUDIT SERVICE PROVIDERS
From time-to-time, another part of the organisation will engage the internal audit service provider to perform consulting engagements. Is there a problem with this?

When engaging an internal audit service provider should we use their service agreements?

INTERNAL AUDIT REPORTING ARRANGEMENTS
What are good practice reporting arrangements for internal audit to have effective independence from management?

In my organisation, internal audit reports functionally for its operations to the audit committee through the chair, and administratively to the head of corporate services. Is this a recommended practice?

In government, the chief audit executive (head of internal audit) may be a senior executive but not be sufficiently senior to report directly to the organisation head (secretary, director-general, etc). How does this affect internal audit independence?

INTERNAL AUDIT PLANNING
I have just taken over as chief audit executive of an internal audit function. The internal audit plan I inherited has time allocated to support the external auditor’s work on the annual financial statements audit. Is this normal practice?

CHIEF AUDIT EXECUTIVE PERFORMANCE ASSESSMENT 
I understand good practice internal audit reporting arrangements are for the chief audit executive to report functionally for internal audit operations to the audit committee through the chair, and administratively to the chief executive officer. But who should assess chief audit executive performance?

Can the same person be the chief audit executive in charge of internal audit and also the chief risk officer in charge of risk management?

INTERNAL AUDITOR UTILISATION RATES
What are reasonable internal auditor time utilisation rates? Is there guidance on productive audit time and other time such as administration?

MANAGEMENT INTERFERENCE 
An internal audit report prepared by internal audit formed part of the papers for an audit committee meeting. Between internal audit submitting the report to the secretariat and it reaching the audit committee, it was altered by senior management. How can this be avoided?

What should we do about management saying they will accept risks instead of closing-our audit actions?

INTERNAL AUDIT CAREER
Can you offer some ideas about how I might break into an internal audit career?

GUEST AUDITORS
I’ve heard of the concept of using guest auditor specialists from within the business to bring technical expertise to audits? Wouldn’t this be a problem from an independence perspective?

AUDIT COMMITTEE MEMBER KNOWLEDGE
I recently joined an audit committee as an independent member. I don’t know a lot about other things that audit committees cover, including internal audit. What might be some tips?

BALANCED INTERNAL AUDIT REPORTS
Should internal audit reports be 'balanced' by containing positive commentary in addition to what needs to be fixed that was discovered in the audit?

WAGE THEFT
I recently completed an internal audit on payroll which found many employees are being underpaid. I took this up with the chief financial officer who told me if I issued the report in its present format, it would almost certainly affect my employment. What can I do?

INTERNAL AUDITOR IN TROUBLE
If threatened to change a report or face unpleasant consequences, what can an internal auditor do when something like this happens and their job security is threatened?

QUALITY ASSURANCE AND IMPROVEMENT PROGRAM
My internal audit unit recently had a five-year external quality assessment performed but were marked down on Standard 1320 ‘Reporting on the quality assurance and improvement program’. What should be done to conform with this standard?

INTERNAL AUDIT STANDARDS
When preparing the audit file, are internal auditors required to retain copies of all samples and documents tested, or are they only required to retain evidence of exceptions? What do the IIA Standards require? What is the most common practice used by internal auditors?

CERTIFICATIONS
My internal audit unit has in-house internal auditors distributed around the world and quite a number of these say they are Certified Internal Auditors (CIAs). What is the best way to confirm whether someone is certified?


RISK MANAGEMENT
The chief executive officer has asked me to now take responsibility for fraud control and investigations. What are some things I should consider?