How to Gauge the Audit Department?

By Arif Zaman , Head of Internal Audit, Emaar Industries & Investments, UAE

Lead by example – Audit yourself before auditing others!

Internal Audit (IA) Department is no different than any other department in the organization. There are things which influence the performance of the IA department, some are controllable factor and some are not but there are always ways to improve the performance of the IA department by enhancing its process maturity.

“I have been approached by many internal auditors, the first concern they raise is about the budget constraint but in this article, I shall be stating that this could be only one factor but there are numerous other factors by which the internal audit functional maturity can be enhanced.”

Now the question arises how to gauge the process maturity of the IA department? The answer is simple, it can be done in many ways such as by benchmarking your audit function with other good performing companies’ IA department or If you are working within a large Group, then benchmark can be done within the Group by comparing to other Group entities’ Internal Audit set-up and their practices.

I usually take a slightly different approach. I choose to benchmark my audit activities with the Institute of Internal Auditors (IIA) proposed Internal Audit Maturity Assessment Model.

What is IIA Internal Audit Maturity Model?

The maturity model helps in positioning the future state of the internal audit department. The IIA Internal Audit Maturity Assessment Model is a self-assessment tool that provides levels of ambition and concrete best practices that can serve as guidelines for the Head of Internal Audit to formulate strategic objectives, evaluate the current internal audit function and define a road map to achieve the stated objectives. 

Rating on a Scale of 1 to 5

The IIA Internal Audit Maturity Model encompasses five levels. Each level describes the characteristics and capabilities of the internal audit activity. The five levels of the internal audit maturity model are initial, define, implement, managed and optimized.

1. Initial – Internal audit is ad hoc or unstructured, few processes are defined, and practices are performed inconsistently.
2. Define – Internal audit basic practices and procedures are performed on a regular and repeated basis.
3. Implement – Internal audit policies and procedures are defined, documented and integrated into each other.
4. Managed – Internal audit becomes an integral part of the organization’s governance and risk management practice.
5. Optimized – Internal audit focuses on learning for continuous improvement to enhance the capability.

Criteria to Rate Each Activity

The detailed level assessment, pertaining to IIA’s standards requirement with an example (current state case of IA Department), is given below:

Based on the above assessment, you can easily draw a table (fig.1) depicting the status of each standard (IPPF) requirement against the current practice in the IA Department between 1 to 5. In the end, you can simply sum up the total scores and divide the total by 60 (12 standards X 5 levels) and then by multiplying with 5 (scale of 5) to obtain overall rate. Based on the above assessment, the overall rate of the department process maturity on a scale of 1 to 5 lies at 1.75. 

Fig.1 – Internal Audit Process Maturity (Current State)

In the above case study, the IA Department maturity falls at a level 2 (Define) means the IA Department has basic practices and procedures that are performed on a regular and repeated basis.

The average rating for any internal audit department should be at least 3 (Implement) on the scale of 1 to 5. 

Conclusion

The Internal Audit Maturity Model shows the steps in progressing from a level of internal auditing typical of a less established organization to the strong, effective, internal audit capabilities generally associated with a more mature and complex organization.

Reference Material: Benchmarking Internal Audit Maturity, Internal Audit Ambition Model

• About
• Latest Posts

Arif Zaman

Arif Zaman is the Head of Internal Audit at Emaar Industries and Investments (EII) – Private Joint Stock Company. Before joining EII, he was the Group Internal Audit Manager at HSA Group based in Dubai, where he was responsible to look after all the regional teams with primary focus in Middle East, Asia and Africa regions. Prior to that, Arif served for Telenor (Telecommunication) as Internal Audit Executive responsible for finance and technology audit engagements. Before that, Mr. Arif work with Ernst & Young (EY) as a Senior Consultant at Business Risk Advisory Services.
His articles on the topic of cloud computing, audit planning, disruptive technology, governance etc. are published by the Institute of Internal Auditors as well.

Arif holds a MSc in Professional Accountancy from University of London and BSc Hons in Applied Accounting from Oxford Brookes University along with an impressive set of professional certification including the following: Chartered Certified Accountant (FCCA), Certified Internal Auditor (CIA), Certified Information System Auditor (CISA), Certified Fraud Examiner (CFE), Certificate in Control Self-Assessment (CCSA), Certificate in Risk Management Assurance (CRMA), Certified Risk Based Auditor (CRBA), Certified Public Accountant (CPA), Certified General Accountant (CGA) and ISO 31000 etc.

Latest posts by Arif Zaman (see all)

• Agile Auditing Methodology - June 22, 2021
• To Be or Not To Be an Internal Auditor? - June 11, 2021
• Governance, Risk & Compliance (GRC) – Big Time Confusion! - March 11, 2021