INTERNAL AUDIT HEADS CONVENE TO DISCUSS KEY ISSUES

Report from 2007 Annual Forum

The internal audit function in Canada's federal, provincial and territorial governments is having an increasing impact and is facing similar challenges across the country, according to Ontario's Chief Internal Auditor Richard Kennedy.

Summarizing a roundtable discussion at the annual forum of the Government Internal Auditors Council of Canada (GIACC) in Whitehorse, Yukon, Kennedy identified five common challenges facing the internal audit community:

• Recruitment and development
• The quality assurance function
• Governance
• Strengthening controls and processes
• Risk-based audit planning.

The forum, which took place September 26-28, 2007, was co-chaired by Kennedy, CCAF Executive Director Michael Eastman, and Director of the Yukon Government Audit Service John Gunter

In attendance were representatives of the internal audit function from every federal, provincial¹ and territorial government. Additional participants included:

• Brian Aiken, Chief Audit Executive, Royal Canadian Mounted Police
• Roxanne Anderson, Partner, PricewaterhouseCoopers, Ottawa and Treasurer, CCAF Board of Governors
• Luc Lavoie, Executive Director, Institute of Internal Auditors – Canada
• Carol Layton, Deputy Minister, Public Infrastructure Renewal, Ontario
• Andrew Lennox, Assistant Auditor General of Canada
• Jim McCarter, Auditor General of Ontario
• Janet Moodie, Deputy Minister of Executive Council, Yukon
• David Morrison, President, Yukon Energy Corporation.

Recruitment remains a problem area

During the roundtable discussion, it became evident that recruitment and development of audit staff is a major concern for most jurisdictions. Many have difficulty competing with private sector firms; even other public sector employers (e.g. tax offices, auditors general) are often able to pay higher salaries. Senior auditors are reaching retirement age. It is particularly difficult to find and retain specialists in such areas as IT audit.

In response, internal audit offices are using such initiatives as internships to attract new employees, placing increasing emphasis on professional development, attempting to change classifications or pay rates for auditors, and sharing resources among departments.

Trends in the internal audit profession

Roxanne Anderson

• Continuing pressure to focus on risk
• Continued challenge regarding capacity and capability
• Rotational staffing models
• Audit report ratings gaining popularity
• Continuous auditing maintains momentum.

Anderson led forum participants in small group discussions about the impacts of each of these trends in individual jurisdictions.

Perspectives on the internal audit function

Carol Layton Jim McCarter Richard Kennedy

• Ministry staff often have limited awareness of internal audit's role, and may fear internal audit services' discovery or disclosure of errors.
• Internal audit's advisory role has to be balanced with its need to provide assurance services and maintain independence.
• A deputy minister has to work with internal audit to understand the complexities of both ministry and enterprise-wide risks, and put effective, integrated risk management / mitigation strategies in place.

Auditor General McCarter, who had been Ontario's first Chief Internal Auditor, said the legislative auditor and internal audit “serve different masters.”

• An auditor general serves legislators; some auditor general offices focus on financial statement attest audits while others focus on value-for-money / performance audits.
• Internal audit serves management, providing value-added operational advice, assurance services and risk management.

Both the auditor general and internal audit have a responsibility to identify issues in a constructive manner and make pragmatic recommendations, McCarter said. They share the objectives of helping the public service operate as cost-effectively as possible and encouraging sound governance practices, transparency and openness in government.

Regarding clients, he said, internal auditing should be a client-focused, value-added, proactive professional service guided by international standards. It should enhance the ability of clients to prudently manage their resources in meeting their business objectives.

Kennedy said internal audit and auditors general can work towards common goals by strengthening processes and protocols and by coordinating and sharing audit plans and audit work. Internal audit can also play a coordination role between clients and the auditor general, providing input throughout the audit process and advice and support to clients on implementation of the auditor general's recommendations.

In it support to audit committees, Kennedy said internal audit should advise on whether risks are being appropriately addressed through a strong governance, risk, control and compliance framework, appropriate stewardship and an adequate and effective internal audit function. It should advise and report on management action plans to address recommendations, and conduct follow-up audits.

Meeting audit committee needs

Audit committees were the subject of another panel, this one featuring Janet Moodie, Deputy Minister of Executive Council, Yukon; David Morrison, President, Yukon Energy Corporation; and Andrew Lennox, Assistant Auditor General of Canada.

Moodie chairs the Yukon Audit Committee. She said the committee plays an important role in internal audit planning. It ensures the interests of senior managers are reflected in plans, ensures legislative requirements are met, and considers how to support plans of the auditor general.

David Morrison, Janet Moodie & Andrew Lennox

• Are findings accurate?
• Have departments been heard and understood?
• Are sampling and evidence okay?
• Are the findings clear?
• Are the findings fair?
  • Are circumstances taken into account?
  • Are recommendations principles-based, not prescriptive?
  • Were findings presented to allow people to take corrective action?

Moodie said it is important for the audit committee to work with the auditor general. It should share conclusions, be informed about and see results of the auditor general's work, and take the auditor general's plans into account. It should also take advantage of training opportunities available through the auditor general's Office.

David Morrison has served on and chaired audit committees in the past. He said Terms of Reference and a Charter, setting out “who are we, what do we do, and how”, are important if an audit committee is to be effective.

Morrison described several best practices for audit committees:

• An audit committee should be independent of management.
• Internal auditors should be responsible to the committee, and should meet in camera with the committee.
• The committee should have access to technical advice, and its own professional development program.

An audit committee's oversight role is an important part of corporate governance, according to Morrison. In fulfilling this role, a committee should be rigorous and sceptical. Its role should extend to overseeing relations with external auditors.

Assistant Auditor General of Canada Andrew Lennox is responsible for the Auditor General's Vancouver and Edmonton offices and for Yukon, Northwest Territories and Nunavut. He outlined the new federal Policy on Internal Audit and the Directive on Audit Committees.

According to Lennox, a lot has changed over the past 10 years in the area of accountability, with significant implications for audit committees. Key questions remain to be answered, including:

• Are expectations of audit committees too high?
• Will enough qualified people be willing to serve on the growing number of audit committees?
• What should be the role of audit committees in internal controls, environmental auditing, and the management of complaints?

Bob Shahi

GIACC members discussed next steps in their project to identify performance indicators for the internal audit function. The discussion was led by Bob Shahi, Director of the Audit Bureau, Government of the Northwest Territories.

The group agreed to begin collecting basic data in 2008 for a handful of indicators under four categories:

• Audit Committees
• People/Audit staff
• Executive Management and Audit Clients
• Audit Process/Innovation.

Luc Lavoie

Brian Aiken

Brian Aiken, Chief Audit Executive of the Royal Canadian Mounted Police and a member of the IIA Canadian Council, described the IIA's progress in developing a Capability Maturity Model for the internal audit function. A five-level model has been developed and will now be fleshed out and tested. Much of this work, which is intended to apply to the function globally, is being carried out by Canadians Libby MacRae (formerly of CCAF) and Jacques Lapointe (former Chief Internal Auditor of Ontario, nowAuditor General of Nova Scotia).

Range of topics sparks constructive discussion

David Moynagh

Mishèle Bérubé Asifa Baig Amber Ursich

David Moynagh, Director of Audit Plans and Reports and Audit Committees in the Office of the Comptroller General of Canada, provided an overview of the federal government's internal audit policy. Moynagh was joined by Brian Aiken, who described the RCMP's experience to date with implementation of the new policy.

Mishèle Bérubé, directrice exécutive du Comité des responsables de la vérification interne, Government of Québec, talked about recent work in her office on the subject of IT auditing.

Asifa Baig, Senior Manager of Strategic Business Initiatives and Central Administration, Ontario Internal Audit Division, led a discussion about the role of internal audit in enterprise risk management, using Ontario's experience to stimulate the discussion.

Bob Shahi talked about the role of External Assessment Review in meeting Quality Assurance standards prescribed by the Institute of Internal Auditors.

A special thanks from GIACC Members to Amber Ursich from the Government of the Yukon for helping to organize many of the events related to the forum.

Future forums

their jurisdictions from these forums armed with different strategies and tools to help them address the challenges they face.

For this reason, the participants are looking forward to meeting again. The 2008 GIACC forum will take be hosted by CCAF in Ottawa, likely in September or October. Ontario will host the 2009 forum in Toronto, Manitoba will host the 2010 forum in Winnipeg, and Alberta will host the 2011 forum in Edmonton. For more information on GIACC, please contact Nicole Wieczorek