The RMC Advisors

Five Court Cases Every Internal Auditor and Audit Committee Member Should Know

Are your workpapers privileged? The Institute of Internal Auditors (IIA) recently presented a webinar entitled “Five Court Cases Every Internal Auditor and Audit Committee Member Should Know.” The webinar focused on court cases related to privileges that may protect internal audit workpapers and how to protect privileged information.

 Four main privileges related to your workpapers include:

• Work Product
  • Protects work prepared in anticipation of litigation.
• Self-Critical Analysis
  • Protects self-evaluative materials and results of candid assessments of compliance with laws and regulations from discovery when the public interest in preserving the internal evaluations of organizations outweighs a plaintiff’s right to the evidence.
• Attorney-Client
  • Protects communications between client and attorney made for the purpose of obtaining professional legal advice or assistance.  Generally, this implies an establishment of a relationship. Some jurisdictions only allow this privilege with external counsel.
• Accountant-Client
  • Protects information shared by a client and their accountant. The purpose of the accountant-client privilege is to create an atmosphere in which the client is able to provide all relevant information to an accountant without fear of subsequent disclosure.
  • No confidential accountant-client privilege exists under federal law.  Some states including Pennsylvania recognize Accountant-Client Privilege. 
  • Pennsylvania accountant-client privilege statute specifically notes “certified public accountant, public accountant or firm” but does specifically include internal audit.

Accountant-client, attorney-client, and work product privileges do not extend to matters disclosed to a third party.  Reference IIA: Practice Advisory 2400-1: Legal Considerations in Communicating Results for additional information regarding privileges.

 

Core Competencies for Today’s Internal Auditor

Another recent report similar to the Internal Audit Activity Summary in the IIA’s Global Internal Audit Survey focuses on core competencies for internal auditors.

Do your internal audit employees and management have the industry’s core competencies? Why is competence important? The IIA’s Code of Ethics requires competency based on the following rules:

• Rule 4.1 – “Internal auditors shall engage only in those services for which they have the necessary knowledge, skills, and experience”
• Rule 4.3 – “Internal auditors shall continually improve their proficiency and the effectiveness and quality of their services”

 Competencies, Skills, and Knowledge

The survey noted the following core competencies were highly ranked for all levels of the internal audit activity (staff, management, and CAE).

• Communication skills
• Problem identification and solution skills
• Keeping up to date with industry and regulatory changes and professional standards.

The survey considered technical skills very important and ranked them in the following order:

• Understanding the business
• Risk analysis and control assessment techniques
• Identifying types of controls

Internal Audit Activity Characteristics

  

How does your internal audit activity compare to your competition?  How are you preparing for upcoming changes in the internal audit industry?

 In 2010, the Institute of Internal Auditors (IIA) completed a survey of internal audit activities.  The survey focused on three key areas:

1. Internal audit activities, scope, structure, and reporting structure
2. Demographics of internal auditors and their organizations
3. Staffing issues

The following is a summary of this survey; consider the ranked responses and compare them to your internal audit environment.  You may find areas for change or improvement based on these insights.

Internal Audit Activities

 The top five highest ranked activities currently performed by internal auditors are:

• Operational audits
• Compliance audits
• Financial risk audits
• Fraud investigations
• Evaluating effectiveness of control systems

In contrast, the top five emerging activities identified over the next years by internal auditors include:

• Corporate governance reviews
• Enterprise risk management audits
• Reviews of linkage of strategy and company performance
• Ethics audits
• Migration to IFRS

Auditors will need to adapt and strengthen their skills to align with emerging internal audit activities.  Currently, 43% of organizations co-source or outsource a portion of the internal audit activity.  25% of respondents in the survey anticipated increases in the co-sourcing/outsourcing budget.

What Can Internal Audit Learn from the IIA Down Under?

Why do we care what is happening in Australia? In this global economy, it is important to leverage best practices and forward thinking ideas when available. In this case, Australia has consistently ranked ahead of the US on the Corruption Perceptions Index issued by Transparency International. The Corruption Perceptions Index is on a scale from ten (10 - very clean) to zero (0 - highly corrupt). Check out the Transparency International website for more details of their annual studies.

Corruption Perceptions Index (CPI)
Year	Australia		United States
	Rank	CPI	Rank	CPI
2010	8	8.7	22	7.5
2009	8	8.7	19	7.5
2008	9	8.7	18	7.3
2007	11	8.6	20	7.2
2006	9	8.7	20	7.3
2005	9	8.8	17	7.6
2004	9	8.8	17	7.5

 

Lessons Learned

What are some of the lessons learned that we in the US could leverage from Australia? Achieving High Performance, a study completed by the IIA and Protiviti, provides some insight into the Internal Audit profession in Australia and how they function. Some key lessons learned include:

What do Audit Committees at high achieving companies do?

• Appoint and remove the Chief Audit Executive.
• Approve the scope and budget of the Internal Audit plan.
• Approve the Chief Audit Executive’s salary.
• Evaluate the performance of the Chief Audit Executive.

What are the top five priorities of the Chief Audit Executives?

• Internal controls over the core financial processes.
• Proactive involvement in major project implementations.
• Attesting to risk management.
• Information Technology.
• Strategic risk.

IIA Australia Policy Agenda

The IIA in Australia is calling for action to reduce the reputational scandals and destruction of shareholder value that continues in all industries.  Their recommendations include five policy principles, which apply to all organizations. These policy statements call for effective self-regulation. It is time for organizations to stop relying upon government regulations and to proactively take accountability for their organization’s risk management and internal control processes.

Policy 1: Good Governance

Strong Internal Audit Function: Internal Audit provides a separation of ownership and an independence not afforded by management. This independent review function is a critical component of good governance.

Policy 2: Oversight

Strong and Effective Audit Committee: A strong independent Audit Committee is required to maintain oversight of management and the internal audit functions. Key characteristics include:

• At least three members with a majority being independent.
• The Audit Committee Chair is independent and does not chair the board.
• The Audit Committee members collectively provide deep finance, accounting and audit experience.
• The pay for Audit Committee members is commensurate with their workload, experience and personal exposure.

Policy 3: Internal Audit Reporting Lines

Independent Audit Function: Reporting to an active and knowledgeable Audit Committee is important to maintain the independence of the Internal Audit function. Key audit committee oversight functions include:

• The Board makes Chief Audit Executive (CAE) hiring and firing decisions based upon Audit Committee recommendations.
• The Audit Committee recommends and approves the Chief Audit Executive’s compensation.
•  Based upon the Chief Audit Executive’s recommendations, the Audit Committee decides audit scope and budget.
• The Chief Audit Executive reports all audit work to the Audit Committee who regularly monitors progress against the audit plan.
• The Audit Committee monitors the Internal Audit function including:   
  • 1) Audit Committee Chair private meetings with the CAE, and 
  • 2) Audit Committee meetings with the CAE without management at least annually.

Policy 4: Accountability for Risk Management and Internal Controls

Management Accountability: A risk culture where management is aware of and owns risks and risk mitigation strategies are keys to proactive risk management and internal control. Steps to accomplish this include:

• Implementation of an effective system of risk management and internal control.
• Management attests quarterly or annually that:
  • 1) The system of risk management and internal control is effective, and 
  • 2) They have reported all known material risks to the board with a true status of these risks.
• Internal Audit independently reviews and advises the Board on management’s attestation.
• Awareness that delegation of management’s attestation requirement to Internal Audit is not appropriate.

Policy 5: Internal Audit Maintains a High Standard

IIA International Standards for the Professional Practice of Internal Auditing (Standards): The IIA Standards provide solid guidance for effective management and operations of an Internal Audit function. Requirements of the Internal Audit function should include:

• Mandatory use of the IIA Standards.
• Audit Committee commissioning of an external quality review every five years. Internal Audit provides a plan for remediation of any issues found during the review.
• Maintenance of active IIA membership by the Internal Audit function.
• The CAE and internal auditors who issue reports maintain active IIA certification.

Conclusion

An effective, independent Internal Audit function serves as a deterrent and reduces the opportunity for risks to elevate to the level of reputational damage or erosion of shareholder value. Do you have an Internal Audit function? If so, are you getting the unaltered facts?

For any questions, contact Elaine Nissley, Principal at ENissley@macpas.com.

References

Transparency International: http://www.transparency.org/

IIA Australia: www.iia.org.au/