|
From The AICPA Audit Committee Toolkit.
Copyright © 2004 by the American Institute of Certified Public Accountants,
Inc., New York, New York.
| Purpose
of This Tool. The sample questions included in this tool are
only a starting point to assist the audit committee in evaluating
the performance and effectiveness of the internal audit team. Follow-up
questions should be considered as appropriate. |
Audit Committee Relationship with the Internal Audit
Team
It is in the best interest of all concerned for the audit committee
and the internal audit team to maintain a strong positive relationship.
The audit committee should view the internal audit team as its eyes and
ears about what is going on within the company. The audit committee should
promote a relationship of healthy professional skepticism between the
chief audit executive and the CFO, though it is these two individuals
that will likely spend the most time working with the audit committee.
The audit committee chair and the leader of the internal audit team (the
chief audit executive or CAE) should have frequent contact between meetings
of the audit committee. In fact, the CAE should have a “solid-line”
reporting relationship to the audit committee (with a “dotted-line”
reporting relationship to a senior executive in the organization for administrative
purposes), and the audit committee should be consulted before the CAE
can be hired, fired, or reassigned.
At every audit committee meeting the committee should hold an executive
session with the CAE to ask specific questions (see also the tool “Conducting
an Audit Committee Executive Session: Guidelines and Questions”
in this toolkit). It is best for the audit committee to ask specific,
yet open-ended questions, and to probe deeper with the CAE on answers
that might be puzzling or incomplete. The CAE should be forthcoming with
information including the results of audits conducted as well as audits
currently underway. The internal audit team must recognize that it is
an agent of the audit committee and not management.
The CAE should be the keeper of the audit committee charter, and should
consult with the committee chair and the CFO in developing meeting agendas.
Periodically, the CAE should review with the audit committee the staffing
needs of the internal audit team, and the competencies of the individuals
filling those positions.
In times of cost cutting, the internal audit function may be targeted
for reductions along with many other functions in the organization. As
a best practice, the internal audit team should not be the victim of a
corporate downsizing; in fact, it is at precisely this time that the internal
audit team should be doing extra monitoring regarding the safeguarding
of corporate assets, the integrity of the internal control system, and
related matters.
Discussions between the CAE and the audit committee should also address
the competencies of the financial management team. The internal audit
team is in the best position to determine whether the financial management
team is able to address complex accounting issues on its own, or whether
it relies too heavily on the independent auditor or other consultants
for evaluation and decision-making.
The audit committee should also promote a positive working relationship
between the CAE and the independent auditor. If possible, the independent
auditor should rely on the work of the internal auditor to supplement
or limit its own testing. Generally accepted auditing standards (GAAS)
requires that the independent auditor maintain control of the work being
performed on its behalf, and to re-perform some of the testing to reach
its own conclusion about the work of the internal auditor.
Finally, the audit committee should periodically assess the performance
of the CAE and the internal audit team to ensure that they are appropriate
agents of the audit committee in the organization. The following tool
includes some sample questions that the audit committee should ask itself
in evaluating the effectiveness of the internal audit team.
Instructions for Using This
Tool. The sample questions included in this tool are only a starting point
to evaluating the performance and effectiveness of the internal audit
team. Audit committee members should ask follow-up questions as appropriate.
| Evaluation of Internal Audit Team |
Yes |
No |
Not
sure |
Comments |
| 1. Does the department appear to be using its time and resources
effectively and efficiently? |
|
|
|
|
| 2. Are the department’s size and structure adequate to meet
its established objectives? |
|
|
|
|
| 3. Is the experience level of the internal auditors adequate? |
|
|
|
|
| 4. Does the department appear to be objective? What procedures are
performed to ensure objectivity? |
|
|
|
|
| 5. Is the technical knowledge of the department members sufficient
to ensure that duties are performed appropriately? |
|
|
|
|
| 6. Does the department have an appropriate continuing education
program? |
|
|
|
|
| 7. Are there department members with sufficient information systems
auditing expertise to address the level of technology used by the
organization? |
|
|
|
|
| 8. Is the department’s work planned appropriately? |
|
|
|
|
9. Does planning include written audit plans and programs?
|
|
|
|
|
| 10. What types of reports are issued by the internal audit department
and to whom? |
|
|
|
|
Notes:
|
11. Are the internal audit reports issued on a timely basis?
|
|
|
|
|
| 12. Do the internal audit reports include sufficient detail for
effective action by management and/or the audit committee? |
|
|
|
|
| 13. Does management respond in an appropriate and timely fashion
to significant recommendations and comments made by the internal auditors? |
|
|
|
|
| 14. Do internal audit procedures encompass operational as well as
financial areas? |
|
|
|
|
| 15. Was the department’s involvement in the annual audit effective? |
|
|
|
|
| 16. What could be done in the future to maximize the department’s
effectiveness and efficiency? |
|
|
|
|
Notes:
|
| 17. To what extent is outsourcing used in the internal audit function,
what areas are outsourced, and to whom are they outsourced? |
|
|
|
|
Notes:
|
| 18. Does the internal audit team have a periodic “peer review”
performed and, if so, what were the results of the latest review? |
|
|
|
|
Notes:
|
| 19. What criteria are used to establish and prioritize the annual
and long-range internal audit plan? |
|
|
|
|
Notes:
|
20. Is the department’s work concentrated in areas of high
risk, judgment, and sensitivity?
|
|
|
|
|
| 21. To what extent does the internal audit team keep itself informed
about, and involved in professional activities? |
|
|
|
|
Notes:
|
| 22. What are the internal auditor’s views regarding controls,
the risk of fraud, and compliance matters? |
|
|
|
|
Notes:
|
| 23. Has the charter of the internal audit department been evaluated
to determine it is still appropriate? |
|
|
|
|
Notes:
|
Other Questions or Comments
|
From The
AICPA Audit Committee Toolkit. Copyright ©
2004 by the American Institute of Certified Public Accountants, Inc., New
York, New York.
|
