Is there room in Internal Audit for Accountants?

This is going to be one of those articles that you will either love or hate. Like MARMITE. For my Australian friends that’s a product much better than Vegemite; for my American cousins, I can’t really explain MARMITE, you’ll have to taste it. But it is well known that you either Love it or Hate it.

Now over the years, I have been known to call a spade a spade and not duck out of disagreements with accountants over their perverse requirement to try and claim domination over Internal Audit. In fact, in the UK, I have had many a verbal battle with the Chartered Institute of Public Finance Accountants (CIPFA), who for years tried to claim they were the only ones with any right to set standards for internal audit in the UK public sector, despite only having half an examination paper out of eight on the subject.?But those days are behind us now; there is a genuine cooperation between the two Institutes, aimed at improving internal audit in the UK public sector.

But in the developing economies of this world, we still have a plethora of accountancy bodies trying to claim ownership over Internal Audit. In many African countries, the local IIA face competition from the local Accountancy body and often it is the accountancy body to whom Government turns?when it wants to regulate something about the profession or set standards. In India, the ICAI (Institute of Chartered Accountants in India) even has the cheek to have Internal Audit standards. The standards bear an uncanny resemblance to the IIA Global Standards, in fact, some people might have the opinion that they have been copied but not I.?I believe that anyone setting standards for Internal Audit is bound to come up with the same things.

?Take the SIA 7, “Quality Assurance in Internal Audit”. This Standard sets the tone for “A system for assuring quality in internal audit should provide reasonable assurance that the internal auditors comply with professional standards, regulatory and legal requirements so that….”?

What does the IIA say “A quality assurance and improvement program is designed to enable an evaluation of the internal audit activity’s conformance with the Standards and an evaluation of whether internal auditors apply the Code of Ethics. The program also assesses the efficiency and effectiveness of the internal audit activity and identifies opportunities for improvement….”?The IIA goes on to state “The quality assurance and improvement program must include both internal and external assessments.”

?Now wouldn’t you just know it, but the ICAI Standards on Quality Assurance also mandates both Internal Quality Reviews and External Quality Reviews.?In fact, the only place where there is a difference is in the frequency of the external review, with the ICAI stating it should be “not less that once in three years” and IIA Global stating “at least once every five years”.

But it isn’t the purpose of this article to criticise the ICAI or any other accountancy body; the purpose is to question whether accountancy bodies have a right to raise questions over the role of internal audit and setting ?standards for the profession. And it is also to raise the question of whether accountants understand the real role of internal audit.

We all know that internal audit has its foundations in accountancy. We still see a vast number of Internal audit units who report to the Finance Director and who are co-located with the finance department.?In fact, I believe I am right in saying that in the United States, the State internal audit teams undertake financial statement audit and therefore, as such, have to have knowledge of accounting and accounting standards to do their job. ?But it is clear that the world of Internal Audit has moved on, away from the pure finance grind and into an organisational role; not just content on counting beans but making sure they are the best beans for the money.

And it is this internal audit world, where you are as likely to find a Quantity Surveyor as an Aerospace Engineer, that the Accountant has the temerity to believe they can regulate. Someone who has studied cashflow and asset valuation suddenly has the knowledge to opine on the risks facing the latest research project. Not all internal auditors have such specialist knowledge; this is accepted and there is always scope in the best run units to second experts from the business or to add external expertise to the team.

?In the early 1990s, it used to be said that the average internal audit unit spent about 18% of its time on auditing financial systems; the rest of the time being spent on risk areas in other parts of the organisation. The introduction of SOX regimes in the USA, and other parts of the world, potentially threw this figure upwards but many organisations have now settled for a compliance-based SOX unit, outside of the Internal audit unit, allowing internal audit to evaluate the risks surrounding such control mechanisms rather than compliance with them.

?It appears quite clear that the internal audit profession has undoubtedly changed and has moved on from the financial role that marked its birth. Accountants have a role to play as does any professional with business acumen. There is however a fundamental difference. Internal Auditors do not have to be members of the Institute of Internal Auditors to carry out their role, although it helps if they have gained the professional qualification. Unlike accountants, they do not need to be licenced or members of a professional body to undertake the role.

The fact that there is no compulsion to be a member of the IIA makes the fact that there are over 218,000 members globally a fantastic achievement. But the IIA staff hierarchy has to understand that this lack of compulsion can be a double-edged sword. Many professionals do not like what their professional body gets up to and do not appreciate the high cost of membership but cannot vote with their feet because they are required to be members to be part of that profession. So, when the staff at the IIA want to bring in practices that seem to have more in common to a body of which membership is compulsory, they need to think long and hard as to what the impact may be on membership. The IIA is a very different animal than any of the accountancy bodies.

?Will the move to a stronger regime for CPE really benefit the profession or will it have a negative impact? Is the threat to remove the CIA designation from those that do not meet the CPE requirement an empty threat; the fact remains you do not need the CIA to undertake professional internal audit. There is nothing to stop a non-member stating in their publicity that they follow the standards of the IIA; as I have shown earlier, IIA Global does not have sole bragging rights over internal audit standards. In fact, in the UK public sector you are required to follow the PSIAS which are the public sector interpretation of the International standards.

?I can appreciate the reasoning behind the changes, although as you can probably tell, I don’t think enough thought has gone into the impact a potential backlash could have. Its like the Quality Assurance in the Standards. This particular section of the Standards has been mandatory since 2002, which means that long established internal audit units should by now be in the stages of a 4th or 5th iteration of the QAR.

?In the 2010 Common Body of Knowledge (CBOK) survey only 31% of respondents indicated that they had a Quality Assurance and Improvement Programme in place, let alone had?been subject to a Quality Assurance external review. If members had been conforming to the standards, this was eight years after the standard had become mandatory and the rate should have been nearer 100% having had an external review.

?I use this Quality Assurance fact to illustrate my point that it could be more difficult than herding cats to get internal audit to conform to a series of professional standards and the CPE changes are likely to go the same way. Threats to remove a professional qualification that isn’t required in order to work within the profession is an empty threat; it means nothing.?In a world where compliance with standards and practices is entirely voluntary, the art of persuasion is a much more effective tool than threats.

?So, is there a better way of compiling a CPE programme, perhaps one that is based away for a profession that has compulsion as its means of persuasion.?Whilst many professions have similar type requirements to show that skills are being kept up to date, such as pilots requiring simulator training at certain intervals, isn’t it possible that we could devise something a little bit better than attendance at training courses for CPE. I recall when I was involved with Huawei; every year in January the team of approximately 350 auditors were recalled back to base in Shenzhen and training was delivered to all.?I was asked to see if we could make this training more relevant to the professional development of the Huawei auditors, but the training was Huawei specific; it was therefore difficult to classify using the IIA system and so the potential for 350 members went begging as there was no way could CPE be completed by these auditors in the more conventional manner that the IIA recognised.

?The constraints on our profession are really of having the view of the profession imposed from the backdrop of another profession. Rugby is a good example of what we could do. Rugby is alleged to have been invented when William Webb Ellis picked up the ball during a football (soccer) game at Rugby school. But Rugby didn’t blindly take on the rules of soccer; throw-ins were kept but are different, the number of players is different, the goals and scoring are different and overall, despite coming from the same stable, they have different rules and regulations.

?And this is where I think we have to now go as internal auditors. We are not accountants; we have a different role and although we may have started life in the same place, we are now very different. We need to stamp our own personality on our profession. We are now over 80 years old and surely able to throw off the yoke of accountancy that bears us down. As the late Bill Bishop used to shout, “ I am proud to be an Internal Auditor “, I always added “and not a qualified accountant”. ?

I apologise if I have upset anyone, although really you shouldn’t be so sensitive. Let me add that some of my best friends are accountants or they were best friends when I last checked ??.