IIA (Institute of Internal Auditors) Defines Internal Auditing

[Marc]

From: ISO Standards Discussion
Date: Tue, 25 Jan 2000 08:48:18 -0600
Subject: INFO: Internal Auditing Standards /Arter

From: Dennis Arter

The Institute of Internal Auditors (IIA) has revised their definition of internal auditing and is in the process of changing their standards for the practice of internal auditing. (Please note that the IIA is an international professional society and has been doing this stuff since way before we in the quality profession adopted the concept. Their definition may be somewhat different than your definition.)

We can gain much by following in the footsteps of others. The draft (exposure) standards on attributes and performance of an internal audit program are quite applicable to those of us implementing a quality or environmental or safety internal auditing program. If you wish to see the document, and even comment on their content, you can find them on the IIA web site www.theiia.org under "What's New" at the top of the page.

Dennis R. Arter

[Marc]

And the definition is:

"Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations.

It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes."

Bold emphasis mine. Now - what do they mean by consulting? Comments?

[This message has been edited by Marc Smith (edited 05 February 2000).]

[Marc]

With respect to http://Elsmar.com/ubb/Forum13/HTML/000052.html - I wonder how they're defining independence...

[This message has been edited by Marc Smith (edited 10 June 2001).]

[barb butrym]

looks to me as if the IA is given the opportunity to be part of the fix......

[Sam]

How do we determine if an internal audit adds value? What measurement criteria would be used?

[This message has been edited by Sam (edited 10 February 2000).]

Marc,
I have a book here, 'Flawless Consulting' by Peter Block (published by University Associates Inc, San Diego. He defines a consultant as 'a person in a position to have some influence over an individual, a group or an organisation, but who has no direct power to make changes or implement programs. He goes on to say that a manager has direct control and that the moment you take direct control, you are acting as a manager. ie (as I take it); If you were to be asked by one of your clients to tell the people what to do, rather than advise, then according to Peter Block you would no longer be a consultant but a contracted manager.
He goes on to say that most people in staff roles are really consultants. They plan, recommend, assist or advise in such matters as Personnel, Financial analysis, Auditing, Systems analysis, (and another half dozen in the list.)
Maybe the IIA are coming from the same direction. There is a whole section on Internal Consulting.
rgds, John C

[Marc]

John: Haven't read the book but the concept as you present it is valid. The problem is defining who is qualified to be a consultant. Often during internal audits the guy from purchasing is auditing the gal from receiving. The question becomes is the guy from purchasing qualified to advise receiving.

One factor of consulting is that typically a company hires a consultant (internal or external) based upon some expertise in a specific field. You typically want someone with experience in a specific function / arena.

When a company hires an external consultant, I believe they typically do this believing that person or company has much more experience than they do internally (why hire an external consultant who knows less than anyone in your company?). You hire a plumer to fix your pluming - you do not hire one to learn how to plumb and then fix your sink. In fact, this is a big area of contention with consultants who profess experience yet have little or none. Without going into details, there was a somewhat recent post here which disturbed me - a consultant was asking about a subject that the person obviously, and even so stated, had no background in. Needed information in order to 'look good' at a meeting. Really made me wonder.

My position is that quite often (I would say typically) in internal auditing the auditor does not have the qualification(s) to be consulting in the arena being audited. This is not to say they are not qualified through training to perform an internal audit.

In fact, typically this is a source of hostility in companies - internal auditor from purchasing (or whatever) audits receiving (or whatever) and decides receiving's systems need improvement. Receiving gets mad because they do this every day and here comes this person from purchasing telling them how to do their job. Now receiving wants to audit purchasing as they know they can recommend a few things there. And the war is on. In my opinion the auditors, unless specifically qualified, should be restricted to verifying that folks are following their documentation.

Unfortunately, I believe the move is to evolve (increase the 'importance' of) internal audits. Are internal audits important? Yes, I believe they are very important. Should auditors be involved in 'consulting'? Only as a source of information for input to management unless the auditor is specifically qualified in the arena the auditor is auditing which is not typically the case.

Do you want an HR employee telling maintenance how to improve their systems? Do you want a fork truck driver 'consulting' in your calibration laboratory? If so why? Based upon what qualification(s)? If not, why not?

Originally posted by Marc Smith:

Do you want an HR employee telling maintenance how to improve their systems? Do you want a fork truck driver 'consulting' in your calibration laboratory? If so why? Based upon what qualification(s)? If not, why not?

An HR employee is auditing the sytem not the job done. Of course they can suggest improvements.
And please do not think that I'm flaming but even if I am a quality ***. manager I think that you are a litlle bit elitist.

I am working in litlle cie (100 employees) and if I don't use staff and floor employees for internal auditing i'll die in a week or two (burn-out).

Only my 2cents.