Ricardo Correa Fuenzalida
Advisor in the Area of Studies
General Internal Audit Council of the Government of Chile
The world of internal auditing is in turmoil in the face of the social and health crisis in which we find ourselves as a result of the Covid-19 pandemic. Various trade and professional associations, such as the Institute of Internal Auditors (IIA), the Association of Audit and Control of Information Systems (ISACA) and the International Federation of Accountants (IFAC), as well as renowned representatives of the internal auditing discipline, warn that, despite the difficulties, this is a great opportunity to demonstrate our value to the organization and the State in the case of the government sector’s internal auditors since, in addition to ensuring that the always scarce public resources are spent and delivered in a correct and timely manner, we are called upon by our knowledge and expertise to advise the authorities so they take preventive and proactive actions to improve control processes, risk management and governance, especially in times of crisis.
Surely, all the internal auditors agree and expect the aforementioned. But, given the assertions in the first paragraph about the role that the internal auditor should assume, it is worth reflecting on how we are prepared to do so adequately. The question then is who are the internal auditors that are best prepared to seize the opportunity to become one of the most reliable and relevant pillars for the authorities in this crisis environment?
This question could have several answers. It will surely depend on, among other factors, the organizational culture and political environment of the country, the economic sector to which the organization belongs, the resources available for internal auditing, the level of professional competencies available, and the support of the authorities for internal audit work. Notwithstanding that all the previous options can be valid, the origin of the answer may be the same; in crises, opportunities are better exploited by internal auditors who are moving on the path of continuous improvement of quality and that, therefore, when crises occur, they are already recognized and validated at all levels of the organization and their environment for their vision and ability to propose, to collaborate and to act in reliable, competent and effective manner with the authorities.
On the other hand, it is very difficult that, in a crisis environment, internal auditors who, over time, have mainly developed activities associated with the evaluation of compliance with standards and the application of controls, who have not been adequately trained, who do not meet frequently with the highest authority and who also have not demonstrated to their stakeholders that their work is reliable and of quality, are required to contribute to the decision-making process in the crisis. Moreover, it is very possible that these internal audits will be asked to significantly restrict the scope of their annual plan and their work, with the explanation of not affecting the opportunity in the delivery of resources to citizens who require them, thus further protecting the organization, the occurrence of risks of misuse of resources, and the inefficiency of the operations and activities planned and developed to mitigate the effects of the crisis.
When we refer to continuous quality improvement in internal auditing, we refer to a systematic and disciplined process used to monitor and evaluate that internal auditing fulfills its responsibilities to the highest authorities and to the organization, as defined by senior management, and that the technical criteria to be maintained in the internal auditing profession are met.
At a global level, in order to demonstrate that the internal audit activity complies with the elements previously indicated, it must undergo an independent external evaluation regarding compliance with the mandatory elements of the International Framework for Professional Practice (MIPP), issued by the Institute of Internal Auditors (IIA). This evaluation also reviews the efficiency and effectiveness of operations and identifies opportunities for improvement in the internal audit activity.
According to Standard 1300 – quality assurance and improvement program, issued by the IIA, the director of internal audit must develop and maintain a quality assurance and improvement program (PAMC) that covers all aspects of the internal audit activity. This program includes regular and ongoing external and internal quality evaluations. Each part of the PAMC should be designed to help the internal audit activity add value, improve the operations of the organization, and provide assurance that it complies with the Code of Ethics and the IIA Standards.
What is the difference, then, in a crisis situation, between an internal audit unit that is on the road to continuous quality improvement and one that has not yet started on that road? We can recognize in this difference at least four critical points carried out by the internal audit activity that has an established PAMC:
1.- It maintains closeness and gains confidence from the highest authority of the entity
This materializes through regular interaction with the highest authority through direct reporting, relevant advice, periodic and private meetings to discuss important and sensitive issues, participation in strategic committees of the entity, and direct feedback on work performance from the authority. The internal auditor who demonstrates that he or she adds value to the entity has an important space to communicate his or her opinion and advice to the highest authority.
2.- It demonstrates that its processes and activities are carried out with quality criteria at an international level
This is demonstrated by providing the highest authority and the organization as a whole with assurance and consulting services that have been externally certified for compliance with widely recognized and nationally and internationally validated professional standards and norms, such as the IIA Standards. In this process, they also identify improvement opportunities for the internal audit activity. The accreditation of the audit work under international standards strengthens the confidence in the work of the auditor and the robustness of their opinions, reviewing them with impartiality and a high technical character.
3.- It identifies what its professional competencies are and overcomes existing gaps
By comparing existing competencies in internal auditing against a competency model established as a reference, gaps are determined and training strategies are formulated to overcome them in a timely manner. This point is very relevant given that internal auditors are expected to possess a set of specific competencies to carry out their work in times of crisis, particularly in matters of information and communication technologies (ICT), which have undoubtedly affected the way processes are developed in the organization and how they are audited.
4.- It maintains and demonstrates demanding ethical conduct in its work
Demonstrating that it promotes and complies at all times with the principles of the IIA’s code of ethics and with those of the internal audit activity code itself and of the entity, which reaffirms the respect and ethical trust in its work on the part of the internal audit stakeholders, among which are the highest authority.
Source: Prepared by the author
Internal auditing is a strongly regulated discipline promoting energetic, but flexible, competent and multidisciplinary performance, objective, but embedded in an entity, of which it must know its strategic, tactical and operational aspects. The IIA Standards guide the work of the internal auditor in order to make internal auditing a key cog in the wheel of a public entity.
In short, the call for government internal auditors who hope to take advantage of the opportunity to be the authorities’ pillar of trust in times of crisis, but who have not yet incorporated quality into the development of their activities, is to start working from now on to implement a PAMC, since, in a changing world full of challenges, the next crisis will probably begin as soon as the one we are experiencing ends.
About the author
Ricardo is a public accountant and auditor and a commercial engineer from Universidad de Santiago de Chile. He has a Master’s in Accounting and Management Auditing from the same university.
He has obtained various international professional certifications in matters of internal audit, internal control, risk management and money laundering, among which those sponsored by the Institute of Internal Auditors (IIA), CIA, CRMA, CGAP and CCSA stand out.
He has extensive experience in the governmental internal auditing practice. He currently works as an advisor in the Studies Area of the General Internal Audit Council of the Government of Chile.
Academic and instructor in subjects of his competence in both undergraduate and graduate certification programs in Chile and other Latin American countries.
Speaker at workshops, seminars and national and international conferences (CLAI). He has authored books, publications and articles.
