2009-11-01
By David Chiang, CA, CIA, CMC, ACDA
As a Governor and Board Chair of a College as well as Board Advisor to a large billion-dollar crown agency, I am always interested in new developments in the public sector. And so, I welcomed the opportunity to read the IIA Research Foundation’s recently published study entitled “Internal Audit Capability Model (IA-CM) for the Public Sector” by Elizabeth MacRae. The IA-CM is a framework that identifies the fundamentals needed for effective internal auditing in government and the broader public sector. It illustrates the levels and stages through which an internal audit activity can evolve as it defines, implements, measures, controls and improves its processes and practices.
The IA-CM framework consists of five levels of capability tied to leading practices. These five levels are: Initial, Infrastructure, Integrated, Managed and Optimizing. Each capability level describes the characteristics and capabilities of an internal audit activity at that level and tries to match the complexity of the organization with the capabilities needed to support it.
As I read this document, it supported my belief in the importance of “People Management”. The study defines this as “the process of creating a work environment that enables people to perform to the best of their abilities.” It’s important to clearly understand job requirements and to develop the technical skills to develop staff into highly competent auditors. On many audit engagements, the use of technology to support the work performed by audit teams is critical. With increasing complexity of computer systems and increasing volumes of data throughout many public sector organizations, the use of data analysis software such as ACL and AuditExchange2 is highly relevant to ensuring a quality technology-enabled audit.
Internal audit departments can start by providing leading edge data analysis software and the requisite training to staff to enable them to use this software effectively. By doing so, organizations can improve their status on the Internal Audit Capability Model Matrix from Level 1 – Initial to higher, more productive levels in the matrix
Level 2 – Infrastructure is about ensuring that internal audit departments are equipped with the right set of tools (including audit analysis technology) to perform their work. The union of skilled people with the right tools results in improved benefits to the audit process.
Level 3 – Integrated is about building a cohesive audit team that works collaboratively together in a co-ordinated way. ACL’s newly released AuditExchange2 product does just that. By providing internal auditors with a managed platform, auditors can improve the way in which they manage audit data, results, and documents. The ability to properly share this information in a controlled and secure manner also improves the use of data analysis with a wider audience of auditors. Not to mention the ability to provide stakeholders with more tangible and supported audit results.
Level 4 – Managed describes how an improved internal audit function can contribute to Management Developments. I see this as the culmination of Continuous Auditing and Monitoring in providing important and relevant findings to the operational managers who can then use these findings to improve their processes and controls.
Finally, Level 5 – Optimized is the desired end outcome whereby the use of leading edge technology is fully integrated with the audit departments goals and objectives. At this stage, the organization is benefiting from a well run and highly effective department.
The public sector has a demonstrated need for a universal model which can be used to self-assess and develop the organization. The IA-CM has, in my opinion, delivered on this need with a well researched study. I support the use of the IA-CM by senior management and legislators to evaluate and improve the internal audit activity and, in particular, in the improved usage of audit analysis technology in the performance of their work.
Find out more: ACL Blog
