Practice Review and Internal Audit—Multi-year Plan for Fiscal Years 2012–13 to 2014–15

Practice Review and Internal Audit—Multi-year Plan for Fiscal Years 2012–13 to 2014–15

Practice Review and Internal Audit Mandate

The mandate of the Practice Review and Internal Audit (PRIA) function is to provide independent and objective information, advice, consulting and assurance services to the Auditor General concerning the extent to which Office administrative processes and practices are appropriately designed and effectively implemented; and the extent to which audit practitioners are complying with professional standards, legal requirements and Office policies in the conduct of their audits, and issuing audit reports that are supported and appropriate.

This work is conducted under two sets of professional standards. Internal audits are conducted in accordance with the International Standards for the Profession of Internal Auditing established by the Institute of Internal Auditors, and following the spirit of the Treasury Board Policy on Internal Audit implemented in a way to respect the independence of the Auditor General as an Officer of Parliament. Practice Reviews are conducted in compliance with Canadian Standard on Quality Control CSQC 1 – quality control for firms that perform audits and reviews of financial statements, and other assurance engagements issued by the Canadian Institute of Chartered Accountants.

Objectives of the PRIA Plan

There are two objectives of the PRIA Plan for 2012–13 to 2014–15:

• To identify desired internal audits based on an assessment of Office risks, risk management procedures, and an understanding of Office plans and priorities
• To identify a practice review schedule that meets the requirements of professional standards and addresses the Office’s intent to continuously improve the conduct of its audits.

Process for developing this proposal

The PRIA Plan is based on interviews with all product and service leader assistant auditors general and a sample of audit practitioners. It is based on the results of a risk management workshop involving the Office’s Executive Committee held in July of 2011 and preparations for the Office’s 2012 annual strategic planning meeting. It takes into account input from the Chair of the Office’s Audit Committee. Lastly, it is based on a review of previous PRIA plans, the research conducted to prepare them, and the findings of previous internal audits and practice reviews.

Context

Practice review. The Office is in the final stages of its Renewal of Audit Methodology Project—a major project with an estimated cost of $15 million that has renewed the Office’s audit methodology including its electronic audit file documentation system, updated the design and documentation of the Office’s System of Quality Control, and established a process for ensuring that audit methodology remains current. This project was undertaken in response to findings from internal practice reviews, recommendations from the 2010 international peer review, and feedback from audit practitioners. The result is audit methodology and a System of Quality Control for audits that is at the forefront of the profession.

The number one risk identified by the Office’s Executive Committee in 2011 is the need to support auditors in the exercise of their professional judgement. This context points to the need for the conduct of practice reviews to focus on assessing compliance with professional standards, legal requirements and Office policies while supporting the exercise of professional judgement by practitioners.

Internal audit. Overall, the Office has highly effective management systems and processes that provide strong administrative support to the Office and effectively manage operational risks. Over the past 10 years, the PRIA function has conducted 12 internal audits that have confirmed the effective functioning of these systems while making a number of recommendations for improvements.

At the end of 2011, a new Auditor General began his 10-year term. One of his stated objectives is to undertake a comprehensive review of the Office’s strategic plan and its performance management system with a view to seeking opportunities to improve the Office’s management tools and processes.

Internal audit plan

While those we interviewed in preparing this plan identified some areas where they believed improvements could be made in the management of the Office, in most of these cases an internal audit would not be the best approach to support potential improvements. While an internal audit could be useful in some other cases, the Office’s planned comprehensive review of strategic planning and performance management provides an excellent opportunity for the Office to identify and consider potential improvements in its management and administration. Considering and in support of this, the PRIA team is recommending one internal audit for 2012–13: a follow-up of past internal audit recommendations. In light of the results of the follow-up and the completion of the Office’s strategic planning and performance management review, the PRIA team will determine the nature and timing of internal audits for the balance of the 2012–13 to 2014–15 period and bring those forward for discussion with the Audit Committee in the spring of 2013.

Practice review plan

CSQC-1 requires that a monitoring process be established to provide reasonable assurance that the policies and procedures relating to the system of quality control are relevant, adequate, and operating effectively. This process shall include, on a cyclical basis, inspection of at least one completed engagement for each engagement partner (Principal), but does not prescribe a defined cycle.

There are currently 43 audit practitioners in the Office. Seventeen of these are essentially financial auditors, seven of whom have conducted special examinations; twenty-one are essentially performance auditors, a couple of whom have conducted special exams; and a small number work in all three product lines.

While the basis of practice review is the practitioner, we believe that it is useful to be able to draw conclusions not only on the extent of compliance with standards by individual practitioners, but also of the state of compliance for the Office as a whole as a way to meet the objective of continuous improvement of the Office’s audit practices. Though we have three product lines, these fall into two categories of assurance: financial audits that are attest engagements, and performance audits and special examinations that are direct reporting engagements conducted under the professional standards contained in General Assurance and Auditing Section 5025 of the CICA Handbook.

Therefore, the practice review plan will:

• Create two pools of practitioners: one of attest practitioners, and one of direct report practitioners which will support making observations, where appropriate, for each of these two categories of assurance engagements.
• Review each practitioner in each pool. This will support making observations, where appropriate, for each of the two categories of assurance engagement based on the results of reviews of all practitioners who conduct each type of engagement. While this will lead to some practitioners being reviewed twice within a cycle, the value gained by including all practitioners in each pool outweighs the impact of multiple reviews of a practitioner within a cycle.
• Employ a random sampling program to identify practitioners in each pool for review. This will manage any potential bias in the selection process and support the extrapolation of results from individual practice reviews across the relevant assurance category.
• Use a four year cycle for each assurance category. This will provide for review or each practitioner within a reasonable timeframe and manage any predictability in the selection process.

The extrapolation period for attest audits will be two years. This means that no practice-wide observations could be made for the attest audit practice in 2012–13. Rather, practice-wide observations would begin in 2013–14 and would be made every year after that based on the results from the previous two years. This will require 9 or 10 practice reviews of attest audit practitioners each year, which is comparable to the level of effort in recent years.

The extrapolation period for direct report audits will be three years. This means that no practice-wide observations could be made for the direct report practices until 2014–15 and would be made every year after that based on the results from the previous three years. This will require about 8 practice reviews of performance audit and special examination practitioners each year, which is a doubling of the level of effort in recent years. This doubling of effort will match the level of practice review activity to the level of audit activity in the Office for each of the two categories of assurance reports issued.

In addition to the randomly selected practitioners, additional practice reviews may be conducted in any given year to address situations where it is desirable to accelerate the review of a given practitioner due to the results of past reviews, or to address other Office concerns or specific practice risks.

Practice reviews of attest practitioners will continue to be conducted in the fall; practice reviews of direct reporting practitioners will continue to be conducted in the fall and winter.

Other activities

In addition to the internal audit and practice review plans, the PRIA team will undertake the following activities in 2012–13:

• A comprehensive follow-up of all outstanding recommendations from previous practice reviews
• An analysis of all practice review programs, related templates and reporting forms with a view to streamlining and focusing practice reviews on the most significant areas for review, and to focusing the reporting of reviews on providing the most appropriate information to all involved parties.

Resourcing

To deliver our plan, we require temporary resources to help us conduct practice reviews. As in the past, we will continue counting on senior management to provide people at the principal and director levels. All practice reviews will be carried out internally. External resources will be retained to assist in areas of special expertise and for internal audits, when necessary.

The PRIA team has 4,500 hours available. We will need additional resources (equivalent to 3,800 hours) to be provided by other internal groups to complete our planned activities for the year.

A similar level of activity and effort is expected for the 2013–14 and 2014–15 fiscal years.