Evaluating the Internal Audit Team: Guidelines and Questions


	Home > Professional Resources > Business, Industry, and Government > Audit Committee Effectiveness Center > Not-for-Profit Organizations Toolkit > Evaluating the Internal Audit Team: Guidelines and Questions

Purpose of This Tool. The sample questions included in this tool are only a starting point to assist the audit committee in evaluating the performance and effectiveness of the internal audit team. Follow-up questions should be considered as appropriate. Please also note that many not-for-profit organizations are not large enough to necessitate the formation of an internal audit team. Each organizations audit committee should evaluate the need for such a team before implementing one.

Download a printable version of this Tool

Audit Committee or Board Relationship With Internal Audit Team

It is in the best interest of all concerned for the audit committee or board of directors and the internal audit team to maintain a strong positive relationship. The audit committee should view the internal audit team as their eyes and ears about what is going on within the organization. The audit committee should promote a relationship of healthy professional skepticism between the chief audit executive and the chief financial officer (CFO), though it is these two individuals that will likely spend the most time working with the audit committee.

The audit committee chair and the leader of the internal audit team (the chief audit executive, or CAE) should have frequent contact between meetings of the audit committee. In fact, the CAE should have a solid-line reporting relationship to the audit committee (with a dotted-line reporting relationship to a senior executive in the organization for administrative purposes), and the audit committee should be consulted before the CAE can be hired, fired, or reassigned.

At every audit committee meeting the committee should hold an executive session with the CAE to ask specific questions (see the tool, Conducting an Audit Committee Executive Session: Guidelines and Questions elsewhere in this toolkit). It is best for the audit committee to ask specific, yet open-ended questions, and to probe deeper with the CAE on answers that might be puzzling or incomplete. The CAE should be forthcoming with information including the results of audits conducted, as well as the audit currently underway. The internal audit team must recognize that it is an agent of the audit committee and not management.

The CAE should be the keeper of the audit committee charter and should consult with the committee chair and the CFO in developing meeting agendas.

Periodically, the CAE should review with the audit committee the staffing needs of the internal audit team, and the competencies of the individuals filling those positions. As a best practice, the internal audit team should not be the victim of a downsizing; in fact, it is at precisely this time that the internal audit team should be doing extra monitoring regarding the safeguarding of assets, the integrity of the internal control system, and related matters.

Discussions between the CAE and the audit committee should also address the competencies of the financial management team. The internal audit team is in the best position to determine whether the financial management team is able to address complex accounting issues on its own, or whether it relies too heavily on the independent auditors or other consultants for evaluation and decision-making.

The audit committee should also promote a positive working relationship between the CAE and the independent auditors. If possible, the independent auditors should rely on the work of the internal auditor to supplement or limit their own testing. Generally accepted auditing standards (GAAS) require that the independent audit firm maintain control of the work being performed on its behalf, and to reperform some of the testing to reach its own conclusion about the work of the internal auditor.

Finally, the audit committee should periodically assess the performance of the CAE and the internal audit team to ensure that they are the appropriate agent of the audit committee in the organization. The following tool includes some sample questions that the audit committee should ask itself in evaluating the effectiveness of the internal audit team.

Instructions for Using this Tool. The sample questions included in this tool are only a starting point to evaluating the performance and effectiveness of the internal audit team. Audit committee members should ask follow-up questions where appropriate.

Evaluation of Internal Audit Team	Yes	No	Not Sure	Comments
Does the department appear to be using its time and resources effectively and efficiently?	□	□	□
Are the departments size and structure adequate to meet its established objectives?	□	□	□
Is the experience level of the internal auditors adequate?	□	□	□
Does the department appear to be objective, and what procedures are performed to ensure objectivity?	□	□	□
Is the technical knowledge of the department members sufficient to ensure that duties are performed appropriately?	□	□	□
Does the department have an appropriate continuing education program?	□	□	□
Are there department members with sufficient information systems auditing expertise to address the level of technology used by the organization?	□	□	□
Is the departments work planned appropriately?	□	□	□
Does planning include written audit plans and programs?	□	□	□
What types of reports are issued by the internal audit department and to whom?
Notes:

Are the internal audit reports issued on a timely basis?	□	□	□
Do the internal audit reports include sufficient detail for effective action by management and/or the audit committee?	□	□	□
Does management respond in an appropriate and timely fashion to significant recommendations and comments made by the internal auditors?	□	□	□
Do internal audit procedures encompass operational as well as financial areas?	□	□	□
To what extent does the internal audit team perform certain preparatory audit procedures, including internal control grids, for the independent auditors that would alleviate management from this task?
To what extent does the internal audit team dialog with the organizations independent auditors, including review of management letter comments and regulatory audit reports, e.g., A-133?
To what extent is the internal audit team involved with management and the independent auditors to plan the scope of the external audit, with reference to internal audit areas reviewed by the team since the last external audit?
Was the departments involvement in the annual audit effective?	□	□	□
What could be done in the future to maximize the departments effectiveness and efficiency?
Notes:

To what extent is outsourcing used in the internal audit function, what areas are outsourced, and to whom are they outsourced?
Notes:

Does the internal audit team have a periodic peer review performed and, if so, what were the results of the latest review?	□	□	□
Notes:

What criteria are used to establish and prioritize the annual and long-range internal audit plan?
Notes:

Is the departments work concentrated in areas of high risk, judgment, and sensitivity?	□	□	□
To what extent does the internal audit team keep itself informed about, and involved in, professional activities?
Notes:

What are the internal auditors views regarding controls, the risk of fraud, and compliance matters?
Notes:

Has the charter of the internal audit department been evaluated to determine that it is still appropriate?	□	□	□
To what extent is the internal audit team itself informed about the not-for-profit environment by membership and/or leadership in industry-wide monitoring and/or watchdog groups?
Notes:

To what extent does the internal audit team react to news and information about industry-wide events and possible areas of exposure posed by other not-for-profit organizations?
Notes:

To what extent is the internal audit team involved with the exit conferences between management and regulatory and/or compliance auditors?
Notes:

To what extent does the internal audit team sign off on resolutions of management comments by outside independent auditors?
Notes:

Other Questions or Comments

Download a printable version of this Tool