Appropriate Phrase in IA Report

The internal audit function was brought in-house earlier this year. Therefore, senior management will not pay for an external quality control review for 2006. I agree it would be a waste of time and effort.

I am issuing a internal audit report and wanted to use the phrase "in compliance with the International Standards for the Professional Practice of Internal Auditing provided by the Institute of Internal Auditors".

Is the phrase appropriate without the external review? Could there be a waiver since the audit shop is new?

Practice Advisory 1330-1 states "Initial use of the compliance phrase is not appropriate until an external review, performed within the past five years, has demonstrated that the internal audit activity is in compliance sith the Standards and the Code of Ethics"

Seems pretty clear cut.

I read the advisory and used excerpts in my memo to the Audit Committee to document management's disclosure of noncompliance with the Standards. Thanks.

I thought I read something that new shops have 5 years to complete the review.

DogLover is correct. The quoted Practice Advisory that became effective on 1/1/2002 goes on to say that we've got until 1/2007 to complete the first external assessment and once every 5 years thereafter.

Are there any bank audit shops that are having the quality control reviews done? I think it would be so redundant, since most are reviewed constantly by examiners and external auditors, anyway. I know there would be some distinctions, but you're still getting a pretty good going-over.

I agree that it would be redundant, especially for Banks because of what -5- mentioned. I know this has been discussed here before but to be in compliance with the Standards has anyone undergone a quality reivew?

IMO between the examiners and externals for Banks this should be sufficient to comply - does anyone know if the IIA accepts this as true?

I just looked at the IIA's website and it looks like the Standard was revised...here's the link. Unfortunately I don't think the revision provides much clarity other than what we already knew.

http://www.theiia.org/index.cfm?doc_id=5536

Sorry to hijack - but do we know for sure whether the examiners coming to the Bank and reviewing IA does or does not count as the "external assessment?"

It does not count as the QAR. There is a certification to be able to do QARs.

From the IIA website (theiia.org):

"What qualifications should the lead evaluator possess?
The Professional Practices Framework defines the required competency of the external QA team leaders and team members (Practice Advisory 1312-1: External Assessments).

Interpretation of Standard 1312 from the International Standards for the Professional Practice of Internal Auditing:

Competence — Performing and communicating the results of an external assessment require the exercise of professional judgment. Accordingly, an individual serving as an external assessor should:

* Be a competent, certified audit professional (e.g., CIA, CPA, CA, or CISA) who possesses current, in-depth knowledge of the Standards.
* Be well-versed in the best practices of the profession.
* Have at least three years of recent experience in the practice of internal auditing at a management level.

External assessment team leaders and independent validators (Practice Advisory 1312-2) should have an additional level of competence and experience, such as that gained from working previously as a team member on an external quality assessment, successful completion of The IIA’s quality assessment training course or similar training, and CAE or comparable senior internal audit management experience."

Because your externals are performing other services, I believe they cannot perform the QAR. The banking regulators don't meet the requirement.

I am a small audit shop. I have performed the self-assessment and I am looking for an independent third party to review the self-assessment. My problem is finding the independet party to do the review. One proposal was absolutely ridiculous for the fee given, the others can't do the review until next year. We have considered dropping the IIA phrasing from our audit reports and being done with it.

I am with -5- in that it seems redundant to have this review when the examiners do a review and our independent accountants do a review. Financial institutions should be afforded some level of variance to the Standards.

Unfortunately they didn't leave any other option for highly regulated industries. Did you check the IIA site (if you are a member)? They have a list of vendors.

Otherwise, PM me if you like and I will try to help.

OK - Been a couple years since I was audit director - but what makes this so important for a small internal audit shop? Call me ignorant on this one........

A requirement of the IIA that you can't say you operate in compliance with their standards if you don't. I think there is a catch 22 there if you are an IIA member...you must operate in accordance with their standards. (That is off the top of my head, didn't check that last part about individual auditor members.) The regulatory agencies' guidance mostly says that they expect you to operate in accordance with those standards.

I don't know that anyone has tested it yet to see what will happen if a bank doesn't have its external QAR done every 5 years.

I'm a member, but I don't attempt to make that statement and I don't think I am violating anything (I hope). In fact, I sometimes subcontract for a CPA firm that performs internal audit work for financial institutions and I don't think they subject this portion of their business to peer review or certification (and also don't make the statement) in the reports that I work on. They have never been criticized by the regulators. I'm not sure what the benefits are for smaller in-house audit departments to go through this process. When I managed the audit department it never crossed my mind and it never came up.

The IIA changed the requirements and effective 2007 an independent external review (QAR) is required. I didjust check the code of ethics and it does say that members will conduct audits in accordance with the standards. The standards have the "new" QAR language.

People are scrambling now because the 2007 date is fast approaching. There was lead time of a few years to prepare.

Again, I don't claim to know the repercussions if any of not having a QAR done. If I learn anything I will certainly share.

I wouldn't expect that they'll kick out any bankers who don't claim to be conducting audits in accordance with the Standards, to the extent that it involves QARs. Obviously, I don't speak for the IIA.

So does anyone think we can achieve compliance by disclosing (probably in our charter) non-compliance to the QARs according to Standard 1340?

So in effect we could be in full compliance with the Standards by disclosing our non-compliance to them

Probably would have helped to post 1340...

From the IIA:
Disclosure of Noncompliance
Although the internal audit activity should achieve full compliance with the Standards and internal auditors with the Code of Ethics, there may be instances in which full compliance is not achieved. When noncompliance impacts the overall scope or operation of the internal audit activity, disclosure should be made to senior management and the board.

Quote:

---

Although the internal audit activity should achieve full compliance with the Standards and internal auditors with the Code of Ethics, there may be instances in which full compliance is not achieved. When noncompliance impacts the overall scope or operation of the internal audit activity, disclosure should be made to senior management and the board.

---

I think that says it all.