Professional Documents
Culture Documents
www.emeraldinsight.com/0268-6902.htm
MAJ
22,6 An improved process model
for internal auditing
Michael Elliott
552 AWE Plc., Reading, Berkshire, UK, and
Ray Dawson and Janet Edwards
Department of Computer Science,
Loughborough University, Loughborough, UK
Abstract
Purpose To investigate and understand the reasons why internal auditing is often perceived to not
add value. This paper describes the development of a new process model and approach that will
improve the actual and perceived value of auditing.
Design/methodology/approach Process analysis, identified areas of potential inefficiency and
conflict. The literature review identified the standards and guidance that influence the way internal
auditing is managed and its current trends. A questionnaire was sent to auditors and auditees at AWE
Plc., to gain their views on audit effectiveness and quantify their perception of value.
Findings Questionnaire results show variations in the perceived value of internal auditing,
particularly of some key stages in the process. The management of internal auditing is too focused on
programme achievement, not the resulting value from improvement action.
Research limitations/implications The new process model has yet to be tried in practice, and
this identifies an area of future research. It is envisaged that some additional audit preparation would
be required, and the time taken to conduct an audit may also increase slightly. The financial benefits
quoted by applying the new model would be estimated and may require some justification.
Practical implications The new model should improve audit effectiveness and its perceived
value as the focus changes from simply undertaking an audit, to demonstrating its actual financial
value. It has the potential to significantly influence the way both internal and external auditing is
conducted in the future.
Originality/value The improved process model and cost-benefit audit methodology approach was
found to be unique within the scope of the literature review.
Keywords Internal auditing, Quality, Continuous improvement, ISO 9000 series
Paper type Research paper
Methodology
A review of the activities within the internal audit process was undertaken with the
utilisation of process diagrams. This was developed, initially from first hand
knowledge and experience, with reference to the AWE internal audit procedures,
standards and guidance, and the many authoritative books on auditing (Wealleans,
2000; Russell, 2001; Arter, 1989). This was conducted to a level where the potential
inefficiencies or areas for potential conflict could occur. These issues were then tested in
a questionnaire to validate whether there were indeed problems. Standards and
guidance helped to identify the drivers and influences to internal auditing. Journal and
conference papers, magazine articles and web sites were reviewed to ascertain the
current trends, issues and concerns that currently surround internal auditing.
MAJ Two questionnaires were devised, one for auditors and one for auditees. The
22,6 questionnaires provided the recipients with an opportunity to comment on their overall
perceptions on the value of the auditing process and state whether particular process
elements were strong or weak. As the questionnaires were to be sent out via e-mail,
initial versions were drafted and a small number of face-to-face interviews took place,
with both auditors and auditees, to test the instrument. After the initial alterations, a
554 further pilot study was conducted via e-mail. The e-mail contained a message to
explain the purpose of the questionnaire with suitable encouraging words to offer
recipients the chance to voice concerns and improve the process. With minor
modifications, the final questionnaire was sent out to all five full-time company
auditors and a further 20 from the companys part-time auditor register. A total of 25
questionnaires were also sent to people known to have been audited in the previous
two years. Then a random selection of a further 25 company employees were contacted.
The return rate was an excellent, 100 per cent from the auditors and 54 per cent from
the auditees. The questionnaires contain some common questions so that the results
could be compared and analysed from the two different standpoints.
Questionnaire development
Part of this research seeks to document, what is an effective audit and how it can be
quantified. The questionnaire was designed to capture the internal auditing perceived
value at AWE Plc. This was achieved for the overall process and some of the detailed
stages. These serve as a baseline from which to track any improvements, put in place
as a result of the recommendations from this paper. Terms that describe an effective
audit include reliability of findings added value and client satisfaction
(Beckmerhagen et al., 2004), but these are outcomes and value still requires
quantification.
Beckmerhagen et al. (2004), state an effective audit:
.
has adequately defined audit objectives, approved by all stakeholders;
.
has a suitable plan accepted by all;
.
allows for adequate resources; people and time;
.
is executed by competent auditors;
.
is conducted in accordance with a standard or procedure;
.
has findings that are valid and significant to record which are analysed against
objectives and risk and that lead to improvements;
.
has satisfied clients; and
.
provides evidence of improved working practices.
In the absence of a tangible and quantifiable value for internal audit effectiveness,
Question 1 provides a perceived value from both the auditor and auditee perspective.
This is probably the most significant value from which to track audit improvement
initiatives. This is similar to the IIAs survey question on measuring general respect
(Baker, 2002). It is important to an auditee that they are given sufficient notice of an
impending audit. If insufficient notice is given the audit becomes an inconvenience
with negativity that is hard to erase. Companies with successful audit departments like
Du Pont consider marketing and communication an integral part of the auditing
process (Roth, 2000). Indeed, auditee buy-in should be initiated in the planning
stage. Effective audit planning should result in sufficient notice to all auditees.
1. Overall how would you rate the effectiveness of the audit process?
No value Little Value Some Value Moderately Effective Very Effective
(1) (2) (3) Effective (4) (5) (6)
3.a In general how much effort do auditees make to prepare prior to an audit?
None (1) A little (2) Some (3) Reasonable (4) A lot (5)
7.a How much analysis of the reasons for the deficiencies do you feel is undertaken?
None (1) A little (2) Some (3) A lot (4)
7.b How much analysis (root cause) of the reasons for the deficiency is undertaken in your area?
None (1) A little (2) Some (3) Reasonable (4) A lot (5)
Figure 8.
Auditor Result (7a) Auditee Result (7b)
Q7. Audit deficiency
Average Score Variation Range Average Score Variation Range
analysis
2.30 Medium 1-3 3.05 High 1-5
MAJ Q9. Motivation for future audits. See Figure 10, the auditor result of okay is perhaps
22,6 rather predicable. More significant is the more negative response from auditees. This is
likely to be related to the overall perception of value.
8.a How would you rate the quality of closeout for deficiencies?
Very Poor (1) Poor (2) Reasonable(3) Good (4) Very good (5) Excellent (6)
Figure 9.
Auditor Result (8) Auditee Result (8)
Q8. Quality of
Average Score Variation Range Average Score Variation Range
improvement actions
2.83 High 1-5 2.90 High 1-4
10. How aware are you or have you been of the Company audit programme?
Totally unaware Aware but never Aware but never Aware and Aware of dates
seen it reference it occasionally Ill be audited
Figure 11. (1) (2) (3) reference it (4) (5)
Q10. Programme Average Score Answer Variation Answer Range
awareness
4.00 Low 3-5
11. When you have been audited, how clear were the criteria for a successful audit?
Not at all Poor Some Good Totally clear
(1) (2) understanding (3) (4) (5)
Figure 12.
Average Score Answer Variation Answer Range
Q11. Audit objectives
3.05 High 1-5
something that needs to be managed by the audit manager when selecting auditors An improved
during planning. process model
Q13. Significance of findings. See Figure 14, this result can, in-fact, be interpreted in
two ways. Local areas may be following best practice and only minor issues exist, or
auditors are only finding minor issues. A number of totally insignificant scores were
recorded, which would be of concern.
Q14. Improvement monitoring. See Figure 15, the low score may again indicate that 561
the local management area audited felt that the impact of the original deficiency was
not important.
Q15. Close-out pressure. See Figure 16, if there is relatively little monitoring of
improvement, it is unlikely that local management will be applying pressure to
closeout. It is likely that any real pressure would come from a central organisation
wishing to clear its database of corrective actions.
Discussion
It is evident from the responses to the questionnaire that the internal auditing process
is very well-known and generally perceived as being necessary. Yet behind this
acceptance there are many concerns people have in the way audits are conducted. The
questionnaire results cast doubt on the overall value and added benefit of auditing and
12. In general, how would you rate the audit ors understanding of the subject matter in your area
of interest?
None (1) Poor (2) Some (3) Good (4) Very good (5) Excellent (6)
Figure 13.
Average Score Answer Variation Answer Range
Q12. Auditor knowledge
3.30 High 2-5
15. How much pressure are you under to closeout the deficiency?
None (1) A little (2) Some (3) A lot (4)
Figure 16.
Average Score Answer Variation Answer Range
Q15. Close-out pressure
2.95 High 1-4
MAJ in general this has led to the negative attitude towards it. Of particular concern were
22,6 the answers to Questions 8 and 9, the analysis of problems and the quality of
improvement action to closeout deficiencies. These are two key issues that greatly
impact the effectiveness and value of auditing. They are actions that are under the
direct control of the management of the area that has been audited and demonstrates a
weakness in the general management of this important interface in the auditing
562 process.
The main driver for the internal audit process comes from the need to meet the ISO
9001:2000 Standard clause, 8.2.2, that supports the attainment of gaining, as Vinten
(1998) describes, comfort certification at an acceptable price. Although it is implicit
that opportunities to improve are realised through the identification and action to
address problems found, it is clear that this has not been totally effective, and at times
quite trivial. The system has also been found to be open to abuse, particularly at the
verification stage. If the ISO clause 8.2.2 were to state the audit process had to
demonstrate its own effectiveness then this would significantly change the focus. The
phrase Doing it for the ISO (Wealleans, 2000) is often heard as the objective of
undertaking an internal audit, however to be truly effective, audits require far more
beneficial objectives. Audit investigations are excellent opportunities to provide advice
and guidance on working practices. In third party certification situations this is seen as
providing consultancy (ISO Guide 62), and may adversely affect impartiality. It is
interesting to note that the additional explanation from the International Accreditation
Forum (IAF, 2003) aggressively discourages any form of consultancy. From the
evidence that consultancy-type activities are not described or discussed in
authoritative, internal auditing books or standards (Arter, 1989 and ISO 19011), it
would be reasonable to state that this advice and guidance aspect has also been
eliminated from internal auditing schemes.
Further research
Further research is planned to pilot the above suggested improvements. Models or
checklists will be developed to capture local management behaviour and working
practices, to obtain a true understanding of why compliance has not been achieved.
The reference cost models will be used to assist in estimating the cost impact and other
implications of non-compliance. This will facilitate the estimation of cost-benefits of
implementing the agreed improvement actions. Collation of this data will answer the
question of how much the company is saving as a result of conducting audits.
To further demonstrate the potential improvement of the new internal audit process,
a follow-up auditee questionnaire, similar to the one discussed, will be issued to see if
the perception of value has improved. A successful pilot scheme should lead to the
adoption of the revised system and a subsequent extensive rollout. If these
improvements are realised, some deep-seated negative perceptions on auditing may be
removed.
Conclusion
This research concludes that internal audits are not always well received, they are
sometimes not performed well, and the findings are not always particularly significant,
and at times trivial. Root cause and trend analysis are not sufficiently utilised to help
eliminate future deficiencies. The implementation of the recommendations from this
paper will significantly change both the perceived and actual value of internal
auditing, as its cost-benefit will be recorded.