The great internal audit quiz

Think you know what makes for great internal audit? Graham Liddell argues it’s not just about checklists and offers a handy quiz to help you pin down what makes for a better service.

Last month I reported to our audit and standards committee on my assessment of the effectiveness of the internal audit function I lead.

I went through the checklist, updated last year’s assessment and documented some areas for improvement. The process didn’t add much value and the outcome wasn’t much of a surprise.

I concluded that we were effective and we had no significant departures from public sector internal audit standards.

Since then, I’ve been reflecting on what makes a really great internal audit function and whether there are any obvious measures for chief finance officers to assess the effectiveness of their internal audit function.

Audit teams need to be professional, technically proficient and demonstrate high ethical standards but a great internal audit team needs to offer much more.

There are a couple of clues in the Public Sector Internal Audits Statements mission for internal audit: “To enhance and protect organisational value by providing risk-based and objective assurance, advice and insight”.

Providing risk-based objective assurance is the bread and butter; advice and insight is where we really add value.

Providing advice and insight means doing more than simply pointing out problems. It requires deeper thinking and practical application of auditors’ professional knowledge and experience.

It also suggests a greater degree of engagement in helping organisations manage risk than some auditors may feel comfortable with.

Perhaps, it is notable that whilst the mission highlights the need for objectivity, the word “independent” has gone walkabout.

There are, of course, lots of learned articles about internal audit and some useful best practice available (CIPFA’s statement on the role of the head of IA is well worth a read).

But for the purpose of this article, I thought I would set out a shorter and more subjective set of multiple choice questions to give a five-minute assessment of whether you are getting the most out of your audit function.

Q1. How do you reply if asked why your authority has an internal audit function?

• A. It’s a requirement of the Accounts and Audit Regulations.
• B. They help me pin the blame on someone when something goes wrong.
• C. They are a key partner in helping keep the local authority safe and improving the way we do things.

Q2. Which of the following statements best describes your involvement in the development of the internal audit plan? 

• A. I’m consulted.
• B. I’m actively involved in the process. I work through our assurance map with the head of internal audit and we identify the key areas where we need assurance from IA.
• C. Planning is what the head of internal audit does, so I don’t waste my time getting involved. And by the way, what is an assurance map?

Q3. An internal audit report lands in your inbox. How long does it take you to realise that it includes a major area of concern that needs your urgent attention?

• A. Within the first two or three minutes: The report has a really clear executive summary which highlights the key issues.
• B. Only when I’ve read the whole report.
• C. Not until days, months or even years later when the significance of selected extracts on page nine are pointed out to me.
• D. I already know: My head of internal audit keeps me up to date with the key things I need to worry about and I have started to address the risk.

Q4. Which of the following best describes how audit recommendations are viewed by senior managers?

• A. Fine in theory but we just don’t have the resources to deal with this stuff.
• B. Fine, but the auditors have gone away now and we can safely file the report and ignore.
• C. Oh no, even more things to do. And the audit committee will have our guts for garters if we don’t do something.
• D. Sometimes challenging but always practical and demonstrate an understanding of our key risks and resource constraints. They really help improve the services I am responsible for.

Q5. Which of the following best describes your head of audit? 

• A. Produces the plan and annual opinion. Turns up at audit committees and the odd leadership meeting.
• B. Engages openly and regularly with managers across the organisation, particularly with the Leadership Team and the Audit Committee. Promotes best practice.
• C. We don’t really speak.

I’m sure you can figure out the best answers, but no multiple choice quiz is complete without a scoring system, so here are my suggested scores for each question.

Add the scores together to give an overall rating:

• Total score of 9 or higher: Internal audit is exhibiting some really positive behaviours and is making an impact.
• Total score from 6 to 8: The basics are there, but in times of austerity and change is that good enough? There is so much more your audit team can offer.
• Total score below 5: Oh dear.

Graham Liddell

Graham Liddell is head of Internal Audit at Brighton & Hove City Council.

Get the Room151 Newsletter

Photo (edited): Elaine, Flickr.