Implementation Guide 1311

Standard 1311 – Internal Assessments

Internal assessments must include:

•

Ongoing monitoring of the performance of the internal audit activity.

•

Periodic self-assessments or assessments by other persons within the

organization with sufficient knowledge of internal audit practices.

Interpretation:

Ongoing monitoring is an integral part of the day-to-day supervision, review, and

measurement of the internal audit activity. Ongoing monitoring is incorporated into the

routine policies and practices used to manage the internal audit activity and uses

processes, tools, and information considered necessary to evaluate conformance with

the Code of Ethics and the

Standards.

Periodic assessments are conducted to evaluate conformance with the Code of Ethics

and the

Standards.

Sufficient knowledge of internal audit practices requires at least an understanding of all

elements of the International Professional Practices Framework.

Revised

Standards

, Effective 1 January 2017

Implementation Guide 1311

Implementation Guide 1311 / Internal Assessments

Getting Started

As Standard 1311 indicates, the chief audit executive (CAE) is responsible for ensuring that

the internal audit activity conducts an internal assessment that includes both ongoing

monitoring and periodic self-assessments. Internal assessments validate that the internal audit

activity continues to conform with the

International Standards for the Professional Practice of

Internal Auditing

(

Standards

) and The IIA’s Code of Ethics. The CAE understands that the

internal assessments focus on continuous improvement of the internal audit activity and

involve monitoring its efficiency and effectiveness.

The IIA’s

Quality Assessment Manual for the Internal Audit Activity

or comparable guidance

and tools may serve as a guide to conducting an internal assessment.

Considerations for Implementation

The two interrelated parts of internal assessments — ongoing monitoring and periodic self-

assessments — provide an effective structure for the internal audit activity to continuously

assess its conformance with the

Standards

and whether internal auditors apply the Code of

Ethics. Additionally, they may allow for identification of improvement opportunities.

Ongoing Monitoring

Ongoing monitoring is achieved primarily through continuous activities such as engagement

planning and supervision, standardized work practices, workpaper procedures and signoffs,

report reviews, as well as identification of any weaknesses or areas in need of improvement

and action plans to address them. Ongoing monitoring helps the CAE determine whether

internal audit processes are delivering quality on an engagement-by-engagement basis.

Generally, ongoing monitoring occurs routinely throughout the year via the implementation of

standard work practices. To facilitate this, the CAE may develop templates for internal auditors

to use throughout engagements, ensuring consistency in the application of the

Standards.

Adequate supervision is a fundamental element of any quality assurance and improvement

program (QAIP). Supervision begins with planning and continues throughout the performance

and communication phases of the engagement. Adequate supervision is ensured through

expectation-setting, ongoing communications among internal auditors throughout the

engagement, and workpaper review procedures, including timely sign-off by the individual

Implementation Guide 1311 / Internal Assessments

responsible for supervising engagements. Implementation Guide 2340 – Engagement

Supervision provides further guidance on internal audit supervision.

The implementation guides for the following series of standards provide further guidance on

appropriate performance of an engagement, from engagement planning through the

dissemination of results: 2200, 2300, and 2400.

Additional mechanisms commonly used for ongoing monitoring include:

•

Checklists or automation tools to provide assurance on internal auditors’ compliance

with established practices and procedures and to ensure consistency in the

application of performance standards.

•

Feedback from internal audit clients and other stakeholders regarding the efficiency

and effectiveness of the internal audit team. Feedback may be solicited immediately

following the engagement or on a periodic basis (e.g., semi-annually or annually) via

survey tools or conversations between the CAE and management.

•

Staff and engagement key performance indicators (KPIs), such as the number of

certified internal auditors on staff, their years of experience in internal auditing, the

number of continuing professional development hours they earned during the year,

timeliness of engagements, and stakeholder satisfaction.

•

Other measurements that may be valuable in determining the efficiency and

effectiveness of the internal audit activity. Measures of project budgets, timekeeping

systems, and audit plan completion may help to determine whether the appropriate

amount of time is spent on all aspects of the audit engagement. Budget-to-actual

variance can also be valuable measurement to determine the efficiency and

effectiveness of the internal audit activity.

In addition to validating conformance with the

Standards

and Code of Ethics, ongoing

monitoring may identify opportunities to improve the internal audit activity. In such cases, the

CAE typically addresses these opportunities and may develop an action plan. Once changes

are implemented, key performance indicators can be used to monitor success. Results of

ongoing monitoring should be reported to the board at least annually, as required by Standard

1320 – Reporting on the Quality Assurance and Improvement Program.

Implementation Guide 1311 / Internal Assessments

Periodic Self-assessments

Periodic self-assessments have a different focus than ongoing monitoring in that they generally

provide a more wholistic, comprehensive review of the

Standards

and the internal audit

activity. In contrast, ongoing monitoring is generally focused on reviews conducted at the

engagement level. Additionally, periodic self-assessments address conformance with every

standard, whereas ongoing monitoring frequently is more focused on the performance

standards at the engagement level.

Periodic self-assessments are generally conducted by senior members of the internal audit

activity, a dedicated quality assurance team or individual within the internal audit activity who

has extensive experience with the International Professional Practices Framework (IPPF),

Certified Internal Auditors, or other competent internal audit professionals who may be

assigned elsewhere in the organization. Whenever possible, it is advantageous to include

internal audit activity staff in the self-assessment process, as it can serve as a useful training

opportunity to improve internal auditors’ understanding of the IPPF.

The internal audit activity conducts periodic self-assessments to validate its continued

conformance with the

Standards

and Code of Ethics and to evaluate:

•

The quality and supervision of work performed.

•

The adequacy and appropriateness of internal audit policies and procedures.

•

The ways in which the internal audit activity adds value.

•

The achievement of key performance indicators.

•

The degree to which stakeholder expectations are met.

To accomplish this, the individual or team conducting the self-assessment typically assesses

each standard to determine whether the internal audit activity is operating in conformance.

This may include in-depth interviews and surveys of stakeholders. Through this process, the

CAE is typically able to assess the quality of the internal audit activity’s audit practices,

including adherence to policies and procedures for conducting engagements. Periodic self-

Implementation Guide 1311 / Internal Assessments

assessments may be conducted by a member of the internal audit activity or by other persons

within the organization with sufficient knowledge of internal audit practices, specifically the

Standards

and Code of Ethics.

The internal audit activity may perform additional steps to support the periodic self-

assessment, such as conducting post-engagement reviews or analyzing KPIs.

•

Post-engagement review – The internal audit activity may select a sample of

engagements from a particular timeframe and conduct a review to assess compliance

with internal audit policies (see Standard 2040 – Policies and Procedures) and

conformance with the

Standards

and Code of Ethics. These reviews are typically

conducted by internal audit staff who were not involved in the respective

engagement. In a larger or more mature organization, this process may be handled

by a quality assurance specialist or team. In smaller organizations, the CAE or the

individual responsible for reviewing workpapers may use a checklist, completed after

the final report is issued, to accomplish this review and close the file.

•

KPI analysis – The internal audit activity may also monitor and analyze KPIs related

to the efficiency of standard internal audit work practices (e.g., budget-to-actual

engagement hours, percentage of the audit plan completed, number of days between

fieldwork completion and report issuance, percentage of audit observations

implemented, and timeliness of corrections related to audit observations). Other

commonly used metrics include the number of certified internal auditors on staff, their

years of experience in internal auditing, and the number of continuing professional

development hours they earned during the year.

Following a periodic self-assessment, where appropriate, the CAE may develop an action plan

to address opportunities for improvement. This plan should include proposed timelines for

actions.

Results of periodic self-assessments, which indicate the internal audit activity’s level of

conformance with the

Standards

and Code of Ethics, must be communicated to the board

upon completion, as required by Standard 1320. A periodic self-assessment performed shortly

Implementation Guide 1311 / Internal Assessments

before an external assessment may help reduce the time and effort required to complete the

external assessment (see Standard 1312 – External Assessments).

Considerations for Demonstrating Conformance

Multiple items may indicate conformance with Standard 1311, including any evidence that

ongoing monitoring activities were completed according to the internal audit activity’s QAIP.

Examples may include completed checklists that support workpaper reviews, survey results,

and KPIs related to the efficiency and effectiveness of the internal audit activity, such as an

analysis of budget-to-actual engagement hours. In addition, conformance may be

demonstrated by documentation of completed periodic assessments, which include the scope

of the review and approach plan, workpapers, and communication reports. Finally,

presentations to the board and management, meeting minutes, and the results of both ongoing

monitoring and periodic self-assessment

—

including corrective action plans and corrective

actions taken to improve conformance, efficiency, and effectiveness

—

may indicate

conformance.

Implementation Guide 1311 / Internal Assessments

About The IIA

The Institute of Internal Auditors (The IIA) is the internal audit profession’s most widely recognized advocate, educator,

and provider of standards, guidance, and certifications. Established in 1941, The IIA today serves more than 180,000

members from more than 170 countries and territories. The association’s global headquarters are in Lake Mary, Fla.

For more information, visit www.globaliia.org or www.theiia.org.

About Implementation Guidance

Implementation Guidance, as part of The IIA’s International Professional Practices Framework® (IPPF®), provides

recommended (nonmandatory) guidance for the internal audit profession. It is designed to assist both internal auditors

and internal audit activities to enhance their ability to achieve conformance with the

International Standards for the

Professional Practice of Internal Auditing

(

Standards

Implementation Guides assist internal auditors in applying the

Standards

. They collectively address internal audit's

approach, methodologies, and consideration, but do not detail processes or procedures.

For other authoritative guidance materials provided by The IIA, please visit our website at

www.globaliia.org/standards-guidance or www.theiia.org/guidance.

Disclaimer

The IIA publishes this document for informational and educational purposes. This guidance material is not intended to

provide definitive answers to specific individual circumstances and, as such, is only intended to be used as a guide.

The IIA recommends that you always seek independent expert advice relating directly to any specific situation. The IIA

accepts no responsibility for anyone placing sole reliance on this guidance.

2016 The Institute of Internal Auditors. For permission to reproduce, please contact guidance@theiia.org.