a proactive approach and complete an
independent review of the department.
The QA became a catalyst to reinforce
and strengthen the department’s position within the organization. It also
offered access to professional best practices that would help ensure that the
department was state-of-the-art.
The QA process turned out to be
empowering and surprisingly painless.
The experience has strengthened the
time and effort involved with conducting an internal review and the expense
of doing an external review. Additionally, three managers from the internal
audit department attended The IIA’s
QA training courses to obtain the necessary skills and resources to optimize
The internal review helped clarify the
nuances of a QA and the multiple objectives that could be achieved. It revealed
company planning a QA should universally apply the concept.
The oversight committee helped
develop the objectives for the review,
the request for proposal (RFP), and the
project timeline (see “Internal Audit
Services QA Objectives and Schedule,
page 41), and also assisted with selecting the service provider. The committee’s involvement and oversight
continued during the QA process and
internal audit program and helped raise
the department’s profile throughout the
STARTING FROM WITHIN
Preparation, communication, and a positive attitude are the secrets of an
enriching QA. At Bon Secours, preparations began with the decision to first
include an internally conducted QA of the
departmental objectives. The self-assessment helped prepare for and ultimately get the most value from an
externally conducted QA.
A formal internal review is not always
necessary before undergoing an external QA. In some cases, the results of the
external review are needed to provide the
framework for an ongoing quality control program that gets implemented internally. The key is doing what it takes to
be prepared and to make the process as
effective as possible.
Bon Secours’ preparation included
educating senior management and the
audit committee on the concept of a
QA, which in turn helped justify the
that, in addition to assessing technical compliance with the Standards, a QA
would provide important information
on benchmarking and best practices.
When the time came for the external review, the internal audit department, management, and the board knew
exactly what to expect. Perhaps more
importantly, the internal audit team
faced the process with confidence.
Everyone was hungry for a fresh perspective, rather than fearing what the
QA might reveal.
INVOLVING SENIOR MANAGEMENT
Upon launching the external review, Bon
Secours formed a QA oversight committee that included the chief financial
officer, chief legal officer, and a member of the audit committee. Having total
buy-in and direct involvement from
these players was critical to the project’s
success. The appropriate people to
involve in an oversight committee will
vary from company to company, depending on the culture and the way management is organized. However, any
through the final report to the audit
The oversight committee provided
much more than a “rubber stamp.” The
committee’s advice and counsel during
the QA was invaluable. Its interactions
with the service provider also gave executives increased respect for the internal audit function.
SELECTING A PROVIDER
Bon Secours issued formal RFPs to four
providers. Based on a model provided by
The IIA, the RFP was a critical document
in communicating expectations to potential service providers (see “Sample Request
for Proposal,” page 42).
Each provider had an opportunity to
learn as much as possible about the company and the internal audit function
through the Bon Secours annual internal audit plan, which was an attachment
to the RFP. The plan is a comprehensive
document that includes internal auditing’s scheduled audits, charter, organizational chart, annual budget, and staff
background and credentials. Providing
INTERNAL AUDITOR FEBRUARY 2004