More than just meeting the standards: Setting up and improving quality management systems in internal audit.

What is expected of internal audit is undergoing a dynamic change. Both internal and external stakeholders continue to formulate new and further-reaching demands.

From the external point of view, a significant component of the driving force behind these changes is connected with the current focus on the corporate governance issue. Besides professional associations, commissions and organizations, governments are also becoming more and more involved and are backing up their demands with corresponding legislation.

Awareness of the importance of the role of internal audit in ensuring corporations are being successfully managed and administered in accordance with the relevant laws and regulations is increasing noticeably. Whereas to begin with references to internal audit were mostly implicit, they are now often explicit and internal audit is increasingly mentioned by name in legislation and recommendations.

The internal demands placed upon internal audit are also changing, with external pressure being one of the factors responsible. And although the internal pressure for change that is currently being felt is still not as great as the external pressure, the impetus from within is now beginning to catch up. The requirement profile is increasingly focusing on:

• Budget and capacity reductions in internal audit
• Improving efficiency in all phases of the auditing process
• More customer-orientation when selecting matters that need to be addressed and in presentations
• Moving toward external management, especially in the case of the position of Chief Audit Executive
• More outsourcing and cosourcing

That this pressure is being exerted by decision makers within many organizations could suggest that they are not all convinced of the ability of internal audit operations to effectively adapt in the current altered situation.

The new role of internal audit has three main facets:

• The portfolio of services is being extended: The idea that auditing is limited to activities such as checking the accounting records is now a thing of the past. The assurance activities of internal audit now include internal control, risk management and governance. In addition, as consulting services gradually take their place in the internal audit portfolio, they are increasingly being utilized and more and more is being expected.
• The self-image of internal audit is changing: Internal audit departments and service providers have to be more prepared than ever to be measured on their ability to fulfill their clients’ expectations. Clients need to be identified and won on the basis of how well their demands can be satisfied. The challenge is then to generate sufficient added value and provide a service that is perceived by increasingly discerning clients to be of high enough quality.
• Stakeholder expectations are increasing significantly: The extent to which internal audit is accepted and valued already depends greatly on how well they live up to their own evaluation criteria. As an independent entity within an organization, internal audit appraises the processes and activities of others. The higher their quality standards when carrying out their own processes and activities, the more likely it is that their recommendations will be well received.

So the new demands (and challenges) involve internal audit products, clients, structure and processes. And it is the optimization of precisely components that is the central concern of quality management systems.

Recognition of this fact was what led the Institute of Internal Auditors (IIA) – as part of the 2001 revision of the “Standards for the Professional Practice of Internal Auditing” – to make a functioning quality management system a compulsory standard for internal audit operations. It requires that the system be regularly audited, both internally and externally.

More on the measurement of quality …