Thread Options
#591500 - 08/01/06 03:17 PM Appropriate Phrase in IA Report
BlueEyedGirl Offline
Member
BlueEyedGirl
Joined: May 2006
Posts: 50
somewhere between here and the...
The internal audit function was brought in-house earlier this year. Therefore, senior management will not pay for an external quality control review for 2006. I agree it would be a waste of time and effort.

I am issuing a internal audit report and wanted to use the phrase "in compliance with the International Standards for the Professional Practice of Internal Auditing provided by the Institute of Internal Auditors".

Is the phrase appropriate without the external review? Could there be a waiver since the audit shop is new?

Return to Top
Audit
#591501 - 08/02/06 05:33 PM Re: Appropriate Phrase in IA Report
Passing storm Offline
100 Club
Joined: Aug 2005
Posts: 111
Here and Now
Practice Advisory 1330-1 states "Initial use of the compliance phrase is not appropriate until an external review, performed within the past five years, has demonstrated that the internal audit activity is in compliance sith the Standards and the Code of Ethics"

Seems pretty clear cut.
_________________________
Don't believe everything you think

Return to Top
#591502 - 08/03/06 03:58 PM Re: Appropriate Phrase in IA Report
BlueEyedGirl Offline
Member
BlueEyedGirl
Joined: May 2006
Posts: 50
somewhere between here and the...
I read the advisory and used excerpts in my memo to the Audit Committee to document management's disclosure of noncompliance with the Standards. Thanks.

Return to Top
#591503 - 08/15/06 06:47 PM Re: Appropriate Phrase in IA Report
DogLover Offline
100 Club
DogLover
Joined: Aug 2003
Posts: 146
Sunny Florida
I thought I read something that new shops have 5 years to complete the review.

Return to Top
#591504 - 08/17/06 02:00 AM Re: Appropriate Phrase in IA Report
Latitude2 Offline
Junior Member
Joined: Jul 2004
Posts: 28
DogLover is correct. The quoted Practice Advisory that became effective on 1/1/2002 goes on to say that we've got until 1/2007 to complete the first external assessment and once every 5 years thereafter.

Return to Top
#591505 - 08/24/06 01:25 PM Re: Appropriate Phrase in IA Report
Jokerman Offline
10K Club
Joined: Nov 2003
Posts: 12,846
Are there any bank audit shops that are having the quality control reviews done? I think it would be so redundant, since most are reviewed constantly by examiners and external auditors, anyway. I know there would be some distinctions, but you're still getting a pretty good going-over.

Return to Top
#591506 - 08/24/06 01:39 PM Re: Appropriate Phrase in IA Report
A_G Offline
10K Club
Joined: Jul 2004
Posts: 18,958
I agree that it would be redundant, especially for Banks because of what -5- mentioned. I know this has been discussed here before but to be in compliance with the Standards has anyone undergone a quality reivew?

IMO between the examiners and externals for Banks this should be sufficient to comply - does anyone know if the IIA accepts this as true?
_________________________
With the lights out, it's less dangerous.

Return to Top
#591507 - 08/24/06 01:47 PM Re: Appropriate Phrase in IA Report
A_G Offline
10K Club
Joined: Jul 2004
Posts: 18,958
I just looked at the IIA's website and it looks like the Standard was revised...here's the link. Unfortunately I don't think the revision provides much clarity other than what we already knew.

http://www.theiia.org/index.cfm?doc_id=5536
_________________________
With the lights out, it's less dangerous.

Return to Top
#591508 - 08/24/06 01:59 PM Re: Appropriate Phrase in IA Report
A_G Offline
10K Club
Joined: Jul 2004
Posts: 18,958
Sorry to hijack - but do we know for sure whether the examiners coming to the Bank and reviewing IA does or does not count as the "external assessment?"
_________________________
With the lights out, it's less dangerous.

Return to Top
#591509 - 08/24/06 04:01 PM Re: Appropriate Phrase in IA Report
Kathleen O. Blanchard Offline

10K Club
Kathleen O. Blanchard
Joined: Dec 2000
Posts: 21,277
It does not count as the QAR. There is a certification to be able to do QARs.
Last edited by kaybee (K. Blanchard); 08/24/06 04:02 PM.
_________________________
Kathleen O. Blanchard, CRCM "Kaybee"
HMDA/CRA Training/Consulting/Mapping
The HMDA Academy
www.kaybeescomplianceinsights.com

Return to Top
#591510 - 08/24/06 04:37 PM Re: Appropriate Phrase in IA Report
Kathleen O. Blanchard Offline

10K Club
Kathleen O. Blanchard
Joined: Dec 2000
Posts: 21,277
From the IIA website (theiia.org):

"What qualifications should the lead evaluator possess?
The Professional Practices Framework defines the required competency of the external QA team leaders and team members (Practice Advisory 1312-1: External Assessments).

Interpretation of Standard 1312 from the International Standards for the Professional Practice of Internal Auditing:

Competence — Performing and communicating the results of an external assessment require the exercise of professional judgment. Accordingly, an individual serving as an external assessor should:

* Be a competent, certified audit professional (e.g., CIA, CPA, CA, or CISA) who possesses current, in-depth knowledge of the Standards.
* Be well-versed in the best practices of the profession.
* Have at least three years of recent experience in the practice of internal auditing at a management level.

External assessment team leaders and independent validators (Practice Advisory 1312-2) should have an additional level of competence and experience, such as that gained from working previously as a team member on an external quality assessment, successful completion of The IIA’s quality assessment training course or similar training, and CAE or comparable senior internal audit management experience."

Because your externals are performing other services, I believe they cannot perform the QAR. The banking regulators don't meet the requirement.
Last edited by kaybee (K. Blanchard); 08/24/06 10:46 PM.
_________________________
Kathleen O. Blanchard, CRCM "Kaybee"
HMDA/CRA Training/Consulting/Mapping
The HMDA Academy
www.kaybeescomplianceinsights.com

Return to Top
#591511 - 08/24/06 10:31 PM Re: Appropriate Phrase in IA Report
davidm Offline
100 Club
davidm
Joined: Mar 2003
Posts: 119
Texas
I am a small audit shop. I have performed the self-assessment and I am looking for an independent third party to review the self-assessment. My problem is finding the independet party to do the review. One proposal was absolutely ridiculous for the fee given, the others can't do the review until next year. We have considered dropping the IIA phrasing from our audit reports and being done with it.

I am with -5- in that it seems redundant to have this review when the examiners do a review and our independent accountants do a review. Financial institutions should be afforded some level of variance to the Standards.

Return to Top
#591512 - 08/24/06 10:49 PM Re: Appropriate Phrase in IA Report
Kathleen O. Blanchard Offline

10K Club
Kathleen O. Blanchard
Joined: Dec 2000
Posts: 21,277
Unfortunately they didn't leave any other option for highly regulated industries. Did you check the IIA site (if you are a member)? They have a list of vendors.

Otherwise, PM me if you like and I will try to help.
_________________________
Kathleen O. Blanchard, CRCM "Kaybee"
HMDA/CRA Training/Consulting/Mapping
The HMDA Academy
www.kaybeescomplianceinsights.com

Return to Top
#591513 - 08/24/06 11:11 PM Re: Appropriate Phrase in IA Report
rlcarey Offline
10K Club
rlcarey
Joined: Jul 2001
Posts: 79,234
Galveston, TX
OK - Been a couple years since I was audit director - but what makes this so important for a small internal audit shop? Call me ignorant on this one........
_________________________
The opinions expressed here should not be construed to be those of my employer: PPDocs.com

Return to Top
#591514 - 08/25/06 12:02 AM Re: Appropriate Phrase in IA Report
Kathleen O. Blanchard Offline

10K Club
Kathleen O. Blanchard
Joined: Dec 2000
Posts: 21,277
A requirement of the IIA that you can't say you operate in compliance with their standards if you don't. I think there is a catch 22 there if you are an IIA member...you must operate in accordance with their standards. (That is off the top of my head, didn't check that last part about individual auditor members.) The regulatory agencies' guidance mostly says that they expect you to operate in accordance with those standards.

I don't know that anyone has tested it yet to see what will happen if a bank doesn't have its external QAR done every 5 years.
_________________________
Kathleen O. Blanchard, CRCM "Kaybee"
HMDA/CRA Training/Consulting/Mapping
The HMDA Academy
www.kaybeescomplianceinsights.com

Return to Top
#591515 - 08/25/06 12:54 AM Re: Appropriate Phrase in IA Report
rlcarey Offline
10K Club
rlcarey
Joined: Jul 2001
Posts: 79,234
Galveston, TX
I'm a member, but I don't attempt to make that statement and I don't think I am violating anything (I hope). In fact, I sometimes subcontract for a CPA firm that performs internal audit work for financial institutions and I don't think they subject this portion of their business to peer review or certification (and also don't make the statement) in the reports that I work on. They have never been criticized by the regulators. I'm not sure what the benefits are for smaller in-house audit departments to go through this process. When I managed the audit department it never crossed my mind and it never came up.
_________________________
The opinions expressed here should not be construed to be those of my employer: PPDocs.com

Return to Top
#591516 - 08/25/06 01:02 AM Re: Appropriate Phrase in IA Report
Kathleen O. Blanchard Offline

10K Club
Kathleen O. Blanchard
Joined: Dec 2000
Posts: 21,277
The IIA changed the requirements and effective 2007 an independent external review (QAR) is required. I didjust check the code of ethics and it does say that members will conduct audits in accordance with the standards. The standards have the "new" QAR language.

People are scrambling now because the 2007 date is fast approaching. There was lead time of a few years to prepare.

Again, I don't claim to know the repercussions if any of not having a QAR done. If I learn anything I will certainly share.
_________________________
Kathleen O. Blanchard, CRCM "Kaybee"
HMDA/CRA Training/Consulting/Mapping
The HMDA Academy
www.kaybeescomplianceinsights.com

Return to Top
#591517 - 08/28/06 03:23 PM Re: Appropriate Phrase in IA Report
Jokerman Offline
10K Club
Joined: Nov 2003
Posts: 12,846
I wouldn't expect that they'll kick out any bankers who don't claim to be conducting audits in accordance with the Standards, to the extent that it involves QARs. Obviously, I don't speak for the IIA.

Return to Top
#591518 - 08/28/06 04:20 PM Re: Appropriate Phrase in IA Report
A_G Offline
10K Club
Joined: Jul 2004
Posts: 18,958
So does anyone think we can achieve compliance by disclosing (probably in our charter) non-compliance to the QARs according to Standard 1340?

So in effect we could be in full compliance with the Standards by disclosing our non-compliance to them
_________________________
With the lights out, it's less dangerous.

Return to Top
#591519 - 08/28/06 04:22 PM Re: Appropriate Phrase in IA Report
A_G Offline
10K Club
Joined: Jul 2004
Posts: 18,958
Probably would have helped to post 1340...

From the IIA:
Disclosure of Noncompliance
Although the internal audit activity should achieve full compliance with the Standards and internal auditors with the Code of Ethics, there may be instances in which full compliance is not achieved. When noncompliance impacts the overall scope or operation of the internal audit activity, disclosure should be made to senior management and the board.
_________________________
With the lights out, it's less dangerous.

Return to Top
#591520 - 08/28/06 05:00 PM Re: Appropriate Phrase in IA Report
Jokerman Offline
10K Club
Joined: Nov 2003
Posts: 12,846
Quote:

Although the internal audit activity should achieve full compliance with the Standards and internal auditors with the Code of Ethics, there may be instances in which full compliance is not achieved. When noncompliance impacts the overall scope or operation of the internal audit activity, disclosure should be made to senior management and the board.




I think that says it all.

Return to Top
#591521 - 08/31/06 02:34 PM Re: Appropriate Phrase in IA Report
A_G Offline
10K Club
Joined: Jul 2004
Posts: 18,958
Quote:

Unfortunately they didn't leave any other option for highly regulated industries.




Not to beat a dead horse but I found something that speaks to this on the IIA website. (Looks like I should have done some more digging before I asked my question )

From the IIA:

Regardless of an organization’s industry or the internal audit activity’s complexity or size , there are two approved approaches to external QAs...
_________________________
With the lights out, it's less dangerous.

Return to Top
#591522 - 09/25/06 07:24 PM Re: Appropriate Phrase in IA Report
A_G Offline
10K Club
Joined: Jul 2004
Posts: 18,958
I found something that might be of some use in Practice Advisory 1312-1, External Assessments:

5. Qualifications for external reviewers - External reviewers, including those who validate self-assessments, should be independent of the organization and the internal audit activity. The review team should consist of individuals who are competent in the professional practice of internal auditing and the external assessment process. To be considered as candidates to be external assessors, qualified individuals could include IIA quality assuranace reviewers, regulatory examiners, consultants, external auditors...

So maybe the key is to just do a self-assessment and get one of the examiners to validate it!
_________________________
With the lights out, it's less dangerous.

Return to Top
#591523 - 09/26/06 06:15 PM Re: Appropriate Phrase in IA Report
RR Jen Offline
Power Poster
RR Jen
Joined: May 2003
Posts: 3,759
Running and riding everywhere ...
That would be a great...and much easier (and financially appealing to the board) for those of us that are a one person audit shop.

Do you think it would really fly???
_________________________
I don't need any more negativity in my life...be positive and helpful people or I will kick you in the shins!!!

Return to Top

Moderator:  Andy_Z