Internal Audit Administration

• What does Performance Standard 2030 "Resource Management" state?

  The chief audit executive must ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan.
• What is the first step that the CAE should do to implement the standard 2030 - resource management?

  The CAE usually begin by gaining a deeper understanding of the resources available to the internal audit activity in the board-approved internal audit plan.
• What resources are available to the IA activity?

  • The number of IA staff.
  • The number of productive work hours available, which excludes factors such as paid time off, time spent on training, and administrative tasks.)
  • The IA activity’s collective knowledge, skills, and other competencies. (This info may be found in a documented skills assessment, employees’ performance appraisals, and post-audit or regularly scheduled surveys.)
  • Approved budget and funds available for training, technology, or additional staffing.
• Once gaps are identified in the available resources, how should the CAE address the gap?

  • Providing training for existing staff.
  • Hiring additional staff.
  • Hiring an external service provider.
  • Co-sourcing or outsourcing engagements.
  • Using one or more guest auditors, e.g., an expert from within the organization.
  • Developing a rotational audit plan.
• Rotational plans may be used to address the gap in the IA resources, what can they include?

  • Inbound rotation involves filling certain internal audit job positions with employees from the business for a limited period of time.
  • Outbound rotation involves moving internal auditors into business job positions either permanently or for a limited time period, usually between 6 and 24 months.
• What can rotational plans be used for?

  Rotational plans can be used to train middle-level management and executives, to train other members of the business, and to bring specialized skills to the internal audit team.
• A program using "guest internal auditors" may be similar to a "rotation program", but what is the difference between the two?

  The duration of guest auditor involvement is generally for a shorter term.
• It is important that the skill sets of the existing internal audit resources do not become a constraint in how internal audit addresses the risks of the organization.
• As part of resource management, it is recommended that the CAE establish a program for selecting and developing the human resources for the internal audit activity.
• For the internally staffed auditors, the program for selecting and developing the HR resources for the IA activity should include?

  • Developing written job descriptions.
  • Selecting qualified and competent staff.
  • Training and providing continuing educational opportunities for each auditor.
  • Appraising each internal auditor’s performance at least annually.
  • Providing counsel to internal auditors on their performance and professional development.
  • Considering succession planning for management of internal auditing.
• For the externally sourced auditors, the program for selecting and developing the HR resources for the IA activity should include?

  • Selecting qualified and competent individuals aligned to the overall risks and resource needs.
  • Reflecting on the provider’s performance.
  • Developing expectations that sustain strengths, proactively address areas for improvement, and help ensure service excellence.
• What should the IA skill sets be based on?

  • The organization’s risks.
  • The internal audit plan.
  • Value drivers of key stakeholders.
• In order to develop a systematic schedule for IA engagements for the IA plan, the CAE must consider?

  • The organization’s schedule.
  • The schedule of individual internal auditors.
  • The availability of auditable entities.
• What is the benefit of developing a systematic schedule for the engagements in the audit plan?

  This may help avoid assurance fatigue and promote stronger cooperation efforts from the entities that are being audited.