As internal audit becomes ever more vital, CIPFA is consulting on the main requirements for the head of the department
Internal audit has been undergoing a quiet revolution across our public services. Its strongest benefit has become a highly prized commodity – and one that is in short supply.
That commodity is assurance. Boards and audit committees know they haven’t always been getting it, and even when they do, they are not always sure whether to trust it.
And so there has been a growing recognition in many leadership teams of the importance of a modernised internal audit service, reporting to the highest levels and providing independent and objective assurance.
But there is a problem. The role of the internal auditor, more specifically the role of the head of internal audit, is not clearly and consistently understood across the public sector. Given the expectations that are now being laid at the door of the head, particularly in providing an opinion on the whole system of internal audit, it is important to address this quickly.
CIPFA has taken the initiative with its Statement on the role of the head of internal audit in public service organisations, which is currently out for consultation. The statement draws on best practice and regulatory requirements in public services to clarify the role. It also allows organisations to check their arrangements against a guide and to report publicly on compliance.
This statement is structured along similar lines to CIPFA’s Statement on the role of the chief financial officer, including five principles that can be applied across the public sector. These are set out below.
The head of internal audit in a public service organisation plays a critical role in delivering the organisation’s strategic objectives by:
1) championing best practice in governance and management, objectively assessing the adequacy of governance and management of existing risks, commenting on responses to emerging risks and proposed developments;
2) giving an objective and evidence-based opinion on all aspects of governance, risk management and internal control.
To perform this role, the head of internal audit:
3) must be a senior manager with regular and open engagement across the organisation, particularly with the leadership team and with the audit committee;
4) must lead and direct an internal audit service that is resourced to be fit for purpose; and
5) must be professionally qualified and suitably experienced.
For each principle, the statement sets out the governance arrangements that organisations need to ensure that HIAs can operate effectively. In addition, core responsibilities, leadership skills and technical expertise are defined.
Individual audit professionals will find a lot of helpful material in the statement to compare their service with and so improve performance. What is likely to be of equal if not greater benefit will be the ability to use the statement as a way of saying to different groups: ‘Here is what we do, why we do it, and the value it brings to the organisations in which we work.’
However, it is at the audit committee table that the statement could and should have most impact. It is vital that committees do not treat the statement as merely an item ‘to note’. They must take the time to assess their internal audit service against the guide to ensure it has the profile, capacity and skills to meet the increased governance and assurance expectations.
CIPFA recommends that organisations whose service does depart from the statement should explain the reasons. The audit committee can champion such a process and oversee any subsequent development plan.
The institute would like organisations to read and comment on the proposed statement. The deadline is September 10.
Tim Crowley is the director of the Mersey Internal Audit Agency, vice chair of CIPFA’s Audit Panel and a member of the steering group on the role of the head of internal audit in public service organisations
