Professional performance or practice of internal audit

Published: Last Edited:

This essay has been submitted by a student. This is not an example of the work written by our professional essay writers.


This literature review endeavours to examine current knowledge existing in the public domain on the issue of standards or basic elements for the professional performance or practice of internal audit. Numerous sources including books, journal articles, magazine articles and internet publications have been examined for the purpose of this review.

Whilst the meaning and importance of objectives were briefly studied during the exercise, a fairly detailed study is conducted on the norms for professional performance of internal audits, this being the focus of this literature review. The purpose of this study is also to examine the current state of performance measures used in the internal audit function, with emphasis on the types of performance systems and measures being reported and the utilisation of these measures. All information sources examined are specified in the bibliography in the last part of this study.

Significance of IA Performance Measures

As important members of the accountability, viz. auditing profession, it is vital for internal auditors to direct their own activities to enable them to be aligned with their guiding principles and core values. Internal audit professionals, by proactively demonstrating their duty to exercise appropriate performance measures, can enhance their own effectiveness and increase their credibility, whilst auditing the performance measures of other entities (IIA, 2009, p1).

It is important that the profession continues to develop guidelines for the utilisation of internal audit performance measures. Such guidelines will in course of time become valuable managerial tools and useful for internal auditors to promote their worth to organisational boards and their executive managements. The application of performance measures is in line with the objects of accountability and objectivity that are central to the values of the internal auditing profession (IIA, 2009, p2).

The outsourcing of internal audit is also progressively becoming common. It is, therefore, essential to develop guidelines that enable assessment and evaluation between third-party auditors and in-house audit functions and augment the capability of internal auditors to promote their work to organisational boards. It is important that internal auditors should aggressively "practice what they preach". Not only will the appropriate deployment of performance measures result in a more efficient and effective Internal Audit role, it will also make certain that the discipline remains dedicated to the central principles of accountability and objectivity, which are the strengths of internal auditing (IIA, 2009, p19).

Section 3: Systems of Performance Measures

Performance measures on the whole can be defined as metrics that are deployed to gauge the effectiveness and/or efficiency of an activity (Neely et al, 2005, p 27). Rupsys & Boguslauskas (2007) refer to the oft-quoted colloquialism that is valid for all kinds of organisations, "What cannot be measured, cannot be managed". It is for this reason that performance measures are a critical element of any organisation's self assessment process. Appropriate measures enable organisations to continually identify and implement the latest best practices and target their performance alongside their peer groups via their proper application (IIA, 2009, p 2-3).

The systems for gauging performance differ significantly between audit roles because of the immense diversity of entities served by them (Rupsys et al, 2007, p81). It is nevertheless particularly important for all audit functions to correctly use performance measures in order to communicate the worth of the internal audit role to management (Vondra, 1993, p 99). The international SPPIA also requires that all internal quality evaluations include ongoing scrutiny of the internal audit activity performance. Yet, no essentials are outlined in the standards on the manner in which internal auditors should assess and monitor their performance (IIA, 2009, p 2-3).

Whilst the standards do not offer detailed performance measurement prerequisites for internal audit shops, the deficiency of proper performance measurements is among the most frequently mentioned areas for improvement required by them from external quality assurance assessments (Ziegenfuss, 2000a, p102). This deficiency indicates the overall requirement for further improvement in developing internal auditing performance measures (IIA, 2009, p2-3).

Section 4: Objectives and Norms for the Professional Performance of Internal Audit

IIA's 'Professional Practices Framework' (PPF) includes both the updated and latest internal audit standards. This framework enables internal audit activities to engage with other systems of corporate governance (Colbert, 2002, p 2).

The PPF, apart from including the above defined scope of internal auditing, also contains the established "Standards for the Professional Practice of Internal Auditing" (SPPIA), IIA Code of Ethics, practice advisories, and practice and development aids (Colbert, 2002, p 2). The SPPIA encompass the following three sets of mandatory standards:

(1) Attribute standards that depict suitable features of units and individuals performing internal audit work,

(2) Performance standards that relate to the implementation of each internal audit engagement, and

(3) Implementation standards that involve the performance and attribute standards and relay those standards to specific types of audits. These Implementation standards address issues related to particular regions, industries, or types of services (Colbert, 2002, p 2).

The complete system of controls, under the SPPIA guideline 300.06.4, is described as the unified group of control systems that are developed within organisations to accomplish their goals and objectives (Simmons, 2010, p 4).

The SPPIA states under guideline 300.05 that the main objective of internal controls is to give realistic reassurance to managers that: (1) the operating and financial information is dependable and correct, (2) the procedures, policies, plans and the statutory laws and regulations have been complied with, (3) the assets are protected against theft and loss, (4) the resources are deployed effectively and economically, and that (5) the established program and operating targets and objectives will be fulfilled (Simmons, 2010, p 4).

The SPPIA's Standard 300 delineates the scope of Internal Auditing to include (1) the examination and assessment of the effectiveness and sufficiency of internal control systems that is appraising the extent to which controls really provide the realistic assurance that managers require and (2) the examination and assessment of the performance quality in performing allocated responsibilities that is, appraising the extent to which the enterprise has accomplished the aims and objectives laid down by management (Simmons, 2010, p 5).

The SPPIA advocates five objectives to establish whether the business managers are provided reasonable assurance through controls over: (1) financial and operating data, (2) compliances, (3) assets, (4) operations, and (5) operations and programmes (Simmons, 2010, p 5).

The first objective is to establish whether the controls covering financial and operating data give managers realistic reassurances that (a) the operational and financial data is consistent and correct, and (b) the information collating and reporting has been correctly charted, organized and directed. The second objective is to determine whether the rules covering conformity with the policies, plans, procedures, statutory regulations and laws give managers realistic assurance that suitable compliance really takes place and that compliance activities are properly charted, organised and directed (Simmons, 2010, p 4).

The next objective is to resolve whether the controls covering assets give managers practical assurance regarding the existence of assets as also protection against losses ensuing from improper/illegal activities, fire, theft or exposure to the elements. In other words, internal audit is required to give an assurance that activities related to asset acquisition, storage, recording, utilization and disposal have been appropriately charted, organised and directed (Simmons, 2010, p 5).

The fourth objective is to resolve whether the controls covering operations give managers practical assurance that the wherewithal is being deployed economically and efficiently i.e. that the enterprise is operating in the most promising manner. The objective, to elaborate, is to establish whether operating standards have been set up for gauging economy and efficiency (or in other words that activities have been appropriately planned), whether operating standards are comprehended and are being fulfilled, whether variations are identified, investigated and communicated to individuals responsible remedial action, and whether useful remedial action has been taken. To summarise this objective relates to the assessment of appropriate direction of activities (Simmons, 2010, p 5).

The last objective is to establish whether the controls encompassing operations and programmes give managers sensible reassurance that programmes and operations are being implemented as charted and that the outcomes of operations are in agreement with established targets and objectives; namely whether the activities have been planned, managed and directed in order to ensure the doing of correct things by enterprises (Simmons, 2010, p 7).

The SPPIA guideline 350.01.8 explains that these audit objectives aim to establish whether:

the goals and objectives introduced by management are sufficient and have been successfully expressed and communicated,

the required level of outcomes is being achieved,

criteria that hinder satisfactory outcomes and performance are identified, assessed, and managed,

alternative courses of action have been considered to accomplish desired results,

a program or operation balances, copies, overlaps or clashes with other programs or operations,

controls for gauging and reporting the achievement of goals and objectives are satisfactory, and whether

A program or operation is in compliance with appropriate plans, procedures, policies, regulations and laws (Simmons, 2010, p 7).

An internal audit can include all the five audit objectives which will make it a 'full scope audit' or just one or more of the five audit objectives, thereby making it a 'limited scope audit'. The audit scope could be additionally restricted to appraising the adequacy of controls, i.e. the extent to which they offer reasonable assurance. It could be further restricted by appraising the effectiveness of the controls, specifically the extent to which the controls really function as intended by the management (Simmons, 2010, p 7).

Reporting of Performance Measures

Contemporary internal auditing professional standards, despite the significance of efficient performance assessment, proffer negligible direction on the manner of generating and exploiting the performance metrics (IIA, 2009, p1).

Several studies conducted earlier have endeavoured to identify the ways in which performance measures are presently being deployed by the internal audit discipline. One particular survey interviewed chief audit executives (CAEs) and requested them to rank performance measures according to their relative importance (Ziegenfuss, 2000b). The results of the survey suggested that the deployment of performance measures in the internal auditing function is continually shifting. It was also revealed that the best performance practices are yet to be established (IIA, 2009, p2-3).

Whilst the particular metrics employed to gauge internal audit performance differ to some extent for individual organisations, numerous IIA surveys, including the well known 'GAIN Annual Benchmarking Study', have identified the most important metrics to gauge internal audit performance, namely the deployment of customer satisfaction or stakeholder surveys, completed actual versus estimated audits, compliance with the description of internal auditing, and adherence to the Code of Ethics and the mandated Standards. The deployment of a balanced scorecard has also been recognized by the CAEs as important for measurement of IA performance (GAIN, 2009, p18).

CAEs or the internal audit team, depending upon selected performance metrics, can classify them into one of the following four categories, (1) Staff development metrics, (2) Audit plan management metrics, (3) Client satisfaction and coverage metrics, and (4) Value creation metrics (GAIN, 2009, p5). A few examples of the different types of metrics are provided below to clarify their individual natures and ramifications.

Staff development metrics can foe example comprise of the number of staff records for comparable organisations and staffing activity, such as auditor rotation in management positions, promotions, transfers to different departments, the number of staff inducted into the internal audit function from other business units, and terminations. Audit plan management measures could include the number of concluded projects and circulated reports, monthly audit deliverables, time use by type of activity and individual staff members, audit reports in terms of full-time equivalents, cycle times for the reporting and audit process, remedial action status to recognise due remedial activities, and estimated versus actual work hours for respective audit projects (GAIN, 2009, p5).

Client satisfaction and coverage measures could include computation of post-audit customer satisfaction scores and audit resources by subject and area and topic. Value creation metrics could include the number of audits asked for by management and the calculable audit results (GAIN, 2009, p5).

The data for these metrics should be reported from time to time to the audit committee and the senior management. Whilst performance status reports should be furnished at least on a yearly basis, both the senior management and audit committee need to be consulted on the suitable or favoured distribution frequency (GAIN, 2009, p6).

The deployment of a balanced scorecard to gauge internal audit performance can resolve whether the internal audit activity is adding value, contributing to the overall organisational performance or fulfilling its overall, mission and vision objectives. Whilst it is left to each organisation to decide whether the benefits obtained by utilising balanced scorecards offset its costs, some of the benefits of utilising this performance management methodology include (1) rendering a complete snapshot of performance, (2) alignment of the internal audit activity's operations with strategy and stakeholder needs, (3) improvement in the bottom line by means of process efficiencies and cost recoveries, and (4) facilitating benchmarking with other industry peers (GAIN, 2009, p6).

Requirements of Independence and Competence

Independence is a vital attribute of an audit. The evolving position and function of an Internal Auditor has resulted in internal strife within the corporate finance discipline. The Internal auditor needs to have a direct link to the audit committee. Although this has resulted in diminishing the influence of the CFO, it is required to be understood in the larger interest of the enterprise (AIFAI, 2010, p 2).

However, in some enterprises internal audit is still viewed as a necessary evil with the result that some of the concerned corporate staff members are not even trained to assume their required roles. Some business enterprises on the other hand expend large amount of funds, yet have no system to gauge the actual worth of inputs from the internal auditors. Thus, there is an urgent requirement to understand the significance of internal audit. The need is to place the internal audit system in the hands of personnel who understand the fundamentals and can add value to the enterprise (AIFAI, 2010, p 2).

Under these situations outsourcing the performance of the internal audit to established firms who have proficiency in the discipline has numerous natural advantages for any business enterprise. Specialised firms, which mainly focus on internal audit, possess vast expertise and experience in the innovative and emerging spheres for instance globalisation, e-commerce and intellectual property and can well evaluate the consequence of such innovative spheres on the current business. Such firms are also widely proficient in critical matters like detection of weak accounting areas that facilitate frauds, unusual methods deployed by white-collar criminals, deficiencies in accounting software and computerisation that aid financial frauds, the ways in which employees and ex-employees tamper with intellectual property, and loopholes in concluding contracts as well as their legal outcomes (AIFAI, 2010, p 2).

In terms of the competence of internal auditors, the staff allocated to carry out the audit engagement must as a group possess sufficient professional competence for the required tasks (, 2007, p 1). The audit firm's management must evaluate the skill sets required to consider whether its team possesses the critical skills that equal those necessary to discharge a specific mandate or the scope of audits that are required to be performed. Audit firms must thus have appropriate processes for recruitment, engaging, continuous development, evaluation and assignment of staff to ensure the maintenance of a competent workforce. The formality, nature, and extent of the process will rely on various factors like the size of the audit firm, its work, and its structure (, 2007, p 1).

Professional competence is gained from a combination of education and experience. Competencies are not always measured in terms of years of auditing experience since such a quantitative assessment may not correctly reflect the various experiences garnered by an auditor during a certain time period. Maintaining competence via dedication to learning and development through an auditor's professional life is a significant aspect of the audit discipline. Competence permits an auditor to make logical professional judgments (, 2007, p 2).

Failure to use performance measures

The survey referred above revealed that 30 percent of the organisations had not instituted internal audit performance measures. This is an astonishingly large percentage considering that internal auditors continuously highlight the significance of application of superior performance measures to the organisational activities that are being audited. The failure of the internal audit discipline to suitably deploy performance measures can be attributed to (1) lack of standards, (2) complexities in quantifying impact, and (3) lack of sufficient resources (IIA, 2009, p16-17).

Whilst the standards necessitate continuous monitoring of internal auditor performance, there are no detailed guidelines or requirements for internal audit firms to follow. The external quality review is the only existing method that pushes audit firms to comply with the performance measuring practices (IIA, 2009, p16-17).

Much of the effort put in by internal auditors provides critical reassurances to management, the governing board and other stakeholders. The impact of these activities is however frequently hard to quantify. Internal audit firms, because of such reasons often find it hard to gauge their own performance and their conformance with Standards (IIA, 2009, p16-17).

The correct deployment of performance measures entails a time commitment that is difficult for some internal audit functions to meet. The assessment of whether or not to employ performance standards and measures is eventually a cost-benefit analysis. Not all audit firms find it beneficial to utilise performance measures since it requires further outlays of resources, which might not be presently available (IIA, 2009, p16-17).


IIA's PPF contains comprehensive internal audit standards. This framework also enables the internal audit discipline to engage with performance systems of corporate governance. The PPF contains the established SPPIA, practice advisories, IIA Code of Ethics, and practice and development aids.

Numerous IIA surveys have identified the major metrics for measurement of internal audit performance, namely the use of customer satisfaction/ stakeholder surveys, concluded actual versus estimated audits, compliance with the 'internal auditing' definition, adherence to the acknowledged Code of Ethics, compliance with the Standards and the use of balanced scorecards (GAIN, 2009, p18).

The internal audit team can classify the selected metrics into any of the following well-recognised four categories, namely Audit plan management metrics, Value creation metrics, Client satisfaction and coverage metrics and Staff development metrics.

IIA's survey has evidenced that nearly one-third of the respondents confirmed that their organisations do not have established internal audit performance measures. This is surprising considering that superior performance measures should be applied to organisations that are being audited. The failure of the internal audit profession to correctly employ performance measures appears to be due to (1) want of standards, (2) difficulties in computing impact, and (3) inadequate resources.

It is critical that the internal audit discipline persists in developing guidelines for the use of performance measures in order to benefit all organizational stakeholders. These guidelines will become useful managerial tools for assessing internal audit functions and professional performance, in the execution of their accountability and objectivity responsibilities.

Word Count: 3200 words, apart from bibliography