The Auditor-General

Internal Audit

Australian National Audit Office

Commonwealthof Australia 1998

ISSN 1036-7632

ISBN 0 644 38873 0

This work is copyright. Apart from any use aspermitted under the Copyright Act 1968, nopart may be reproduced by any processwithout prior written permission from theAustralian National Audit Office. Requestsand inquiries concerning reproduction andrights should be addressed to:The Publications Manager,Australian National Audit Office,GPO Box 707, Canberra ACT 2601.

3

28 May 1998

Dear Madam President

Dear Mr Speaker

The Australian National Audit Office has undertaken a FinancialControl and Administration audit in accordance with the authoritycontained in the Auditor-General Act 1997.

Financial control and administration audit findings are reportedgenerically. The findings and recommendations contained in thisreport are not therefore necessarily attributable to any oneorganisation, based as they are on a range of experiences. Individualorganisations are identified where they reflect better practice. Thenature and delivery of these types of audits are set out in the FinancialControl and Administration Audit Charter published in 1995.

I present this report of this audit, and the accompanying brochure, tothe Parliament. The report is titled Internal Audit.

Yours sincerely

P. J. BarrettAuditor-General

The Honourable the President of the SenateThe Honourable the Speaker of the House of RepresentativesParliament HouseCanberra ACT

4 Internal Audit

The Auditor-General is head of the AustralianNational Audit Office. The ANAO assists the Auditor-General to carry out his duties under the Auditor-General Act to undertake performance audits andfinancial statement audits of Commonwealth publicsector bodies and to provide independent reportsand advice for the Parliament, the Government andthe community. The aim is to improveCommonwealth public sector administration andaccountability.

Auditor-General reports are available fromGovernment Info shops. Recent titles are shown atthe back of this report. For further informationcontact:

The Publications ManagerAustralian National Audit OfficeGPO Box 707 Canberra ACT 2601telephone (02) 6203 7505fax (02) 6203 7798

ANAO audit reports and information about the ANAOis available at our Internet address:

http://www.anao.gov.au

5

Contents

Results in Brief ..........................................................................................................6

1. Summary ...............................................................................................................7

Background ...................................................................................................9

Objectives and criteria...................................................................................9

Opinion........................................................................................................10

Findings.......................................................................................................10

Better practice.............................................................................................11

Recommendations.......................................................................................11

2. Detailed Findings and Recommendations ............................................................13

Introduction .................................................................................................15

Previous audit coverage..............................................................................15

This audit.....................................................................................................15

Public sector reform ....................................................................................15

The internal audit function............................................................................16

Audit evaluation criteria ...............................................................................16

Management support ...................................................................................17

Risk focus to meet client needs...................................................................20

Internal audit resources...............................................................................22

Continuous improvement .............................................................................25

3. Appendices..........................................................................................................29

Appendix 1 Better practice...........................................................................30

Appendix 2 About the audit ......................................................................................33

6 Internal Audit

Results in Brief1.1. The internal audit function is generally regarded as a key review and monitoringmechanism. It is an important element of any organisation’s control structure andthus of its corporate governance framework.

2.2. To establish the effectiveness of internal audit, the ANAO examined a number ofimportant strategic issues with the potential to impact significantly on internal audit’sperformance such as, its relationships with management; the use of risk-focused clientservice strategies; the appropriate balance of skills and knowledge within internalaudit units; and the use of continuous improvement processes and measurement ofperformance effectiveness.

3.3. The ANAO found that, when compared to international benchmarks, theinternal audit function in the public sector is significantly behind the private sector inrespect to a number of key measures.

4.4. The audit also found that communication between internal audit, itsorganisation’s audit committee and its other clients, required improvement in severalareas, such as the relevance of the audit charter, and the institution of both formaland private meetings with the audit committee and line management.

5.5. Internal audit has not fully embraced a business risk-focused approach and, assuch, does not always effectively address the key business risks in an organisation.

6.6. In relation to the qualifications of internal audit staff, the audit noted asignificant improvement in the ratio of qualified to unqualified professional staff.However, the professional development policies of organisations could provide moresupport, both to those internal auditors with qualifications and to those seekingqualifications.

7.7. The audit found that a minority of internal audit units use ongoing, structuredmethods to obtain data for use in continuous improvement of processes. Specificattention is needed to improve report cycle times.

8.8. While a majority of internal audit units capture and report some usefultimeliness and quality performance information, less attention is paid to the cost-effectiveness of the function itself.

9.9. Internal audit in the Commonwealth public sector has been one of the majorservice activities being affected by out-sourcing and co-sourcing. This audit foundthat 76 per cent of organisations studied either fully contracted out their internalaudit function or complemented their in-house staff with consultants. These ratiosare well in excess of international experience where in-house internal audit unitspredominate.

7

Part One

Summary

8

9

1. Summary

BackgroundBackground1.1.1.1. Internal audit is an importantreview and monitoring function in anyorganisation. An effective internal auditwill strengthen the internal controlstructure of an organisation, therebycontributing to the fulfilment oforganisational objectives as part ofgood corporate governance.

1.2.1.2. The strength of internal auditlies in its independence, characterisedby its direct reporting relationship withsenior management and its lack ofdirect participation in day-to-dayoperations.

1.3.1.3. As the external auditor, theAustralian National Audit Office(ANAO) takes a close interest in theactivities of internal audit due to thecomplementary nature of our respectivefunctions.

1.4.1.4. This is most evident in theannual financial statement audit duringwhich the ANAO evaluates theeffectiveness of internal audit in termsof assessing their contribution, if any,to the financial audit process (this is arequirement of the Australian AuditingStandards—AUS 604 ‘Considering theWork of Internal Auditing’)

1.5.1.5. The ANAO also periodicallyassesses the internal audit functionfrom a broader perspective, forexample, in terms of its overallcontribution to the internal controlstructure of an organisation and thevalue it adds to management decision-making processes.

1.6.1.6. The last major review by theANAO of the internal audit functionwas undertaken in the 1991-92financial year1.

1.7.1.7. This report revisits many of thefindings from that review—however, itadopts a more strategic, rather thanjust an operational, focus.

Objectives and criteriaObjectives and criteria1.8.1.8. The objectives of this audit wereto:

♦ provide assurance to the Parliamenton the effectiveness of internal auditoperations; and

♦ determine whether internal auditgenerally operates at, or near,recognised better practice.

1.9.1.9. The criteria used to measureinternal audit effectiveness were basedon four principles developed as part ofthe audit.

1.10.1.10. These principles and criteria arediscussed in detail in Appendix 1. Theydeal with the level of managementsupport and authority; the use of a risk-focus to address client needs; theappropriate balance of skills andknowledge; and the use made ofcontinuous improvement processes andmeasurement of performanceeffectiveness.

1.11.1.11. The ANAO utilised aninternational database maintained bythe Institute of Internal Auditors in the 1 Audit Report No. 50, 1991-92, ‘Internal Audit inSelected Government Organisations’, June 1992

10 Internal Audit

United States - the Global AuditInformation Network (GAIN) - tobenchmark the audited organisationsagainst international best practice.

1.12.1.12. The audit objectives, scope andapproach are fully detailed in Appendix2 of this Report.

OpinionOpinion 1.13.1.13. The ANAO found the internalaudit function in most organisationswas meeting the expectations of seniormanagement thus fulfilling the rolearticulated through the internal auditcharter.

1.14.1.14. On the basis of the foregoingmeasure the internal audit function canbroadly be regarded as effective.However, when the standards ofinternational best practice areaddressed, it has to be concluded thatthe function in the public sector issignificantly behind the private sector inrespect to a number of key measures.

1.15.1.15. This opinion is formed on thebasis of the findings summarised below.These findings are amplified in ChapterTwo of this Report.

FindingsFindings 1.16.1.16. Based on survey responses fromorganisations, the audit foundmanagement support for the internalaudit function, both general andspecific, was not as strong as could beexpected for such a fundamentalcomponent of the control environmentof an organisation.

1.17.1.17. Of particular concern was theapparent lack of effectivecommunication between a number of

heads of internal audit and their auditcommittees.

1.18.1.18. This finding extended to a needfor improved communication betweeninternal audit and its major audit client—line management—to ensure that internalaudit focuses its activity on criticalbusiness processes and significantbusiness risks.

1.19.1.19. In many organisations internalaudit has yet to make the most effectiveuse of other assurance mechanismssuch as risk and control self-assessment,in order to move from its traditional‘policing’ role towards a more valued-added ‘independent adviser’ role.

1.20.1.20. The issue of the cost-effectiveness of an entirely in-house orco-sourced internal audit function wasalso considered. The ANAO was unableto obtain sufficient evidence to form aconclusive opinion on this issue.

1.21.1.21. In discussions withorganisations that had out-sourced thefunction the clear indication was thatthey were satisfied with the out-sourcing decision. The limited optionsopen to small organisations are alsorecognised as a major consideration inthe out-sourcing decision.

1.22.1.22. Based on the information in theGAIN database, it is noted thatCommonwealth public sectororganisations use out-sourcing ofinternal audit significantly more thanthe international benchmark experienceindicates.

1.23.1.23. Finally, internal audit units needto develop a continuous improvementculture and approach, includingsystematic measurement and reportingof performance effectiveness.

Summary

11

1.24.1.24. With regard to the reportingprocess itself, while the content ofinternal audit reports exceeds relevantbest practice benchmarks this outcomeis diminished, in many cases, by aseeming inability to report in a timelymanner.

Better practiceBetter practice 1.25.1.25. The ANAO observed a smallnumber of public sector organisationsexhibiting better practices in a numberof key respects. These included, forexample, the Australian BroadcastingCorporation (co-sourced) and theAustralian Customs Service (out-sourced).

1.26.1.26. Private sector experience hasseen the role of internal audit changesignificantly over the past few years.Internal audit has become moreinvolved with providing assurance on,and facilitation of, other managementcontrol processes, such as control self-assessment, which operate withinorganisations.

1.27.1.27. More effort has been placed onbuilding a ‘business partner’ role withline management and seeking to addvalue through the provision of decision-support services to senior management.

1.28.1.28. To a large extent this changingrole has been permitted due to thematuration of business systems andprocesses and the increasedsophistication of corporate governancestructures.

1.29.1.29. The outcome of our researchinto private and public sector betterpractices is set out in the better practiceguide developed in conjunction with

this audit.

RecommendationsRecommendations 1.30.1.30. Chapter Two contains thedetailed audit findings andrecommendations which address thematters raised. Theserecommendations are reproducedbelow in summary form.

1.31.1.31. In relation to current internalaudit charters it is recommendedrecommendedthat::

♦ all organisations review and confirmthe continued relevance andappropriateness of their internalaudit charters; and

♦ the chief executive be responsiblefor formally approving the internalaudit charter (paras 2.26 to 2.41refer);

1.32.1.32. In relation to the head ofinternal audit’s relationship with theaudit committee, it is recommendedthat the head of internal audit:

♦ attends all audit committeemeetings; and

♦ meets privately with the auditcommittee (or at least the Chair ofthe committee) at least as frequentlyas the committee itself meets eachyear (paras 2.42 to 2.55 refer).

1.33.1.33. In relation to achieving anappropriate client and risk focus, it isrecommended that internal audit:

♦ as part of the planning process,obtain from line management theirviews of the key business risks facingthe organisation, and solicit theirconcerns and perspective on theoperation of key business processes;and

12 Internal Audit

♦ develop a systematic, formalapproach to planning whichdemonstrates clear linkages betweentheir business risk assessments andtheir strategic and operational plans(paras 2.56 to 2.72 refer).

1.34.1.34. In relation to the otherassurance mechanisms, it isrecommended that organisationsconsider the role that internal auditcould take in the introduction of riskand control self-assessment techniques,as part of their overall governancearrangements (paras 2.73 to 2.82 refer)

1.35.1.35. In relation to the number andmix of internal audit resources it isrecommended that:

♦ chief executives evaluate whetherthe resources they apply to theinternal audit function effectivelymeet the risk profile of theorganisation as well ascomplementing the other relevantreview and monitoring mechanismsin place (paras 2.83 to 2.98 refer);

♦ organisations evaluate theirprofessional development policies inrelation to their internal audit staffprofiles to ensure that the level andtype of training is consistent withthe long-term strategies of theinternal audit unit; and

♦ the chief executive, in consultationwith the audit committee,establishes minimum academic andprofessional qualifications forinternal audit staff, particularly, forthe head of the internal audit unit(paras 2.99 to 2.112 refer).

1.36.1.36. In relation to continuousimprovement activities andmeasurement of internal audit

performance effectiveness, it isrecommended that:

♦ internal audit units developappropriate performance indicatorsto measure the cost-effectiveness,timeliness and quality of theirservices and products; and

♦ ‘in-house’ internal audit units adoptthe use of continuous improvementtools as a means of ensuring theiraudit, management andadministrative processes followbetter practice (paras 2.113 to2.128 refer).

1.37.1.37. In relation to reportingprocesses it is recommended that:

♦ those internal audit units withreport cycle times in excess of 14days, and in particular those inexcess of 30 days, benchmark theirprocesses against better practiceorganisations to determine how bestto reduce their cycle times (paras2.129 to 2.143 refer).

13

Part Two

Detailed Findings andRecommendations

14 Internal Audit

15

2. Detailed Findings andRecommendations

IntroductionIntroduction

Previous audit coveragePrevious audit coverage

2.1.2.1. The ANAO last examined theinternal audit function in 1991-922.That Efficiency Audit was the secondphase in a three-phase review—it waspreceded by a survey undertaken in1989 and reported in 1991, andfollowed by a better practice guide,published in 1993.

2.2.2.2. That audit was ‘not a widereview of internal audit principles, butan evaluation of internal audit practicesagainst principles’3.

2.3.2.3. By contrast, given the significantchanges in the public sector in theintervening period, this present audithas focused on current principles ofbest practice. The audit has sought toestablish whether, and to what extent,present-day internal audit units operatein accordance with these principles.

This auditThis audit

2.4.2.4. The current audit was carriedout in two parts—a survey of 49 publicsector organisations, using the GAINquestionnaire; followed by a detailedreview of twelve of the organisationsparticipating in the survey.

2.5.2.5. Access to the GAIN database,comprising over 700 public and privatesector internal audit organisations, has

2 op. cit., Audit Report No. 50 of 1991-92 3 ibid. , p. 3

been obtained for the next two yearsproviding the ANAO and the surveyedorganisations with a valuable source ofdata for ongoing benchmarking of theiractivities.

Public sector reformPublic sector reform

2.6.2.6. To be relevant and useful anevaluation of the present state of theinternal audit function needs toconsider ongoing financial,management and organisationalreforms—in particular, the impact ofthese reforms on the risk profiles andcontrol frameworks of public sectororganisations.

2.7.2.7. Significant reductions ingovernment spending; down-sizing;restructuring of departments andprograms, including the separation ofpolicy and service delivery; and thetrend towards out-sourcing, aremanifest examples of changes currentlybeing experienced by the public sector.

2.8.2.8. Other recent changes, perhapsless apparent but no less significant,have occurred in relation to theaccountability and financialmanagement arrangements of publicsector organisations. These have beeneffected, in particular, by the suite offinancial management legislationenacted at the beginning of this year.

2.9.2.9. An organisation’s strategicresponse to these changes will includeongoing examination of its corporategovernance frameworks, including its

16 Internal Audit

review and monitoring mechanisms, forexample, in relation to its risk profile, toestablish their continuedappropriateness and effectiveness.

The internal audit functionThe internal audit function

2.10.2.10. The internal audit function isgenerally regarded as a key review andmonitoring mechanism by anorganisation’s management.

2.11.2.11. It is more broadly defined thesedays, than in the past, as an appraisalactivity established within anorganisation as a service to theorganisation.

2.12.2.12. The Institute of InternalAuditors, in its professional standards,describes the function as one whichassists clients, particularly management,in the discharge of their responsibilities.The activities of an internal audit unitmay include analysis and/or appraisal;and the provision of recommendations,counsel and/or information as part ofits assurance functions.

2.13.2.13. The distinguishing feature ofinternal audit is that it is independentwithin the organisation. This isgenerally characterised by theorganisational and reportingarrangements which apply to internalaudit and by the absence ofinvolvement of internal audit personnelin operational activities.

2.14.2.14. The functions undertaken byinternal audit have traditionally focusedon examining, evaluating andmonitoring the adequacy andeffectiveness of the ‘internal control

structure’4 of an organisation—inessence, the management andaccounting controls which operate inrelation to key business systems.

2.15.2.15. However, there is an emergingtrend, particularly within the privatesector, for internal audit to extend itsactivities and influence into areas of riskmanagement and decision-support.

2.16.2.16. The role of the internal auditoris changing from that of a ‘watchdog’,policing management to ensurecompliance, to that of a ‘businesspartner’ with management, acting as anindependent adviser.

2.17.2.17. The extent to which thisforegoing role is appropriate forinternal audit depends in large part onthe maturity of the corporategovernance arrangements andsophistication of the control structureas part of those arrangements withinan organisation.

Audit evaluation criteriaAudit evaluation criteria

2.18.2.18. In evaluating internal audit theANAO has placed significant weightingon the organisational context.

2.19.2.19. The findings in the report reflecta view predicated on the corporategovernance arrangements and controlstructures, as they currently operate, inCommonwealth organisations.

4 Refer to the Better Practice Guide to EffectiveControl, ‘Controlling Performance and Outcomes’,1997 produced by the ANAO for a more detailedexplanation of the control structure.

Detailed Findings and Recommendations

17

2.20.2.20. As discussed previously, thefindings also relate to better practiceprinciples. They therefore have a mainlystrategic perspective.

2.21.2.21. The evaluation criteria used inthe audit are, accordingly, framedagainst the following strategicprinciples:

♦ obtaining appropriate managementsupport and authority;

♦ adopting a risk-focused approachto meet client and organisationalneeds;

♦ getting the mix of audit skills andknowledge right ; and

♦ seeking continuous improvementsin audit and administrativeprocesses.

2.22.2.22. These principles and the specificelements of the criteria used areoutlined in Appendix 1 to this Report.

2.23.2.23. The findings in relation to eachcriterion are discussed separately below.

Management supportManagement support 2.24.2.24. Internal audit derives credibilityand authority for its functions directlyfrom its mandate and indirectly byvirtue of its close relationships with thechief executive and other seniormanagement of an organisation.

2.25.2.25. Overall, the audit found that,while senior management expressedgeneral support for and satisfactionwith internal audit, there are indicationsof a lack of effective communicationwith internal audit and of a lack ofspecific support in defining andsupporting its role throughout theorganisation.

Internal audit chartersInternal audit charters

2.26.2.26. A formal, approved internalaudit charter (or equivalent document)is the mechanism by which seniormanagement communicates to theorganisation its view of the importanceit attaches to the internal auditfunction, the role of audit and itsindependence.

2.27.2.27. A comprehensive charter shouldinclude, as a minimum:

♦ the mission, objectives, powers andfunctions of internal audit;

♦ a statement of its independenceand the source of its authority;

♦ reporting and accountabilitymechanisms; and

♦ organisational and administrativearrangements.

2.28.2.28. The audit found that allorganisations subject to review had acharter which dealt satisfactorily withthe above fundamentals.

2.29.2.29. However, the audit found theauthority provided by using a formalcharter had been diluted, in some cases,by lack of specific approval by the chiefexecutive.

2.30.2.30. The responsibility of the chiefexecutive is to establish and maintain anappropriate internal control structure.An effective internal audit is animportant ‘tool’ which enables the chiefexecutive to monitor the performanceof the control structure as part of goodcorporate governance and theassurance this provides to the variousstakeholders.

2.31.2.31. The chief executive should

18 Internal Audit

therefore directly mandate the internalaudit function through approval of theinternal audit charter.

2.32.2.32. In doing this, it is appropriatefor the audit committee to participatein the development and review of theaudit charter and to endorse it forapproval.

2.33.2.33. The audit also found thatseveral organisations had notundertaken a review of their internalaudit charter for several years.

2.34.2.34. In view of the recent andongoing significant public sectorreforms, including the new legislativeprovisions affecting the operation ofaudit committees, it is consideredappropriate for those organisations torevisit their charters.

2.35.2.35. It is important that chartersreflect current management attitudesand approaches to assurance andcontrol.

2.36.2.36. In discussions with the Chairs ofseveral audit committees it was clearthat management expectations of therole of internal audit did not accordeither with existing charters or with theactual role being undertaken by internalaudit.

2.37.2.37. This has the potential to causeconfusion from both internal audit’sperspective and its client’s perspective.It may also lead to unfocused internalaudit activity which does not add valueand undermines its perceivedusefulness.

Recommendations

2.38.2.38. It is recommendedrecommended that allorganisations review and confirm thecontinued relevance and

appropriateness of their internal auditcharters.

2.39.2.39. It is further recommendedrecommendedthat the chief executive be responsiblefor formally approving the internalaudit charter.

Implementing the recommendations

2.402.40 . The need for and timing of therecommended review should beincluded within the internal auditcharter. It would be appropriate forthe timing of the review to coincidewith the Corporate or Businessplanning cycle of an organisation. Theappointment of a new chair of theaudit committee may also be anappropriate juncture at which to initiatea review.

2.41.2.41. The review is most properlycarried out by the audit committee but,importantly, should encompass inputfrom line management.

Relationship with managementRelationship with management

2.42.2.42. In a previous audit dealing withthe operation of audit committees5 theANAO found that 88 per cent oforganisations with an internal auditfunction also had an audit committeeand that these committees focusedheavily on internal audit activity.

2.43.2.43. The current audit reviewed theeffectiveness of the reporting andinternal communication arrangementsand their impact on the relationshipbetween senior management(represented by the audit committee)and internal audit.

2.44.2.44. In the survey undertaken by the 5 Audit Report No. 39, 1996-97, ‘Audit Committees’,June 1997

Detailed Findings and Recommendations

19

ANAO, using the Institute of InternalAuditors Global Audit InformationNetwork (GAIN), it was noted in anumber of organisations that the roleof internal audit, viewed by the auditcommittee, varied from thatunderstood by line management. Thiswas particularly evident in the case ofinternal audit’s role in operationalauditing (the examination of processesand systems from an efficiency and/oradministrative effectivenessperspective).

2.45.2.45. Whereas 90 per cent of auditcommittees viewed operationalauditing as an important role forinternal audit, only 78 per cent of linemanagement agreed with this view.

2.46.2.46. The survey responses alsoindicate that the chief internal auditor’srelationship with the audit committeecould be improved.

2.47.2.47. Survey respondents indicatedthe majority of audit committees metfour times a year or more.

2.48.2.48. However, the head of internalaudit typically attended auditcommittee meetings in only 62 per centof organisations. This comparesunfavourably with the internationalbenchmark of 82 per cent attendancein the GAIN universe group.

2.49.2.49. The survey results also indicatedthe head of internal audit was unlikelyto meet with the audit committeeprivately—73 per cent of organisationsindicating this did not happen at all.Again this compares unfavourably withthe GAIN population, where 52 percent of heads of internal audit meetprivately with the audit committee atleast once each year - refer Chart 1.

Chart 1 Frequency of privatemeetings

Source: GAIN survey

Note: the chart shows the percentage oforganisations where the head of internal audit metprivately with the audit committee. The frequencyof meetings is expressed in relation to the numberof audit committee meetings held.

2.50.2.50. Further, 28 per cent of allrespondents indicated the head ofinternal audit neither met with theaudit committee privately nor regularlyattended audit committee meetings.

2.51.2.51. These results suggest that, in asignificant number of organisations, therelationship between internal audit, theaudit committee and line management,would benefit from increased contact.One outcome of such contact would bea better understanding by internal auditof the needs of management and of thebusiness.

2.52.2.52. Most audit committee Chairsinterviewed expressed generalsatisfaction with the internal auditfunction. However, in some cases,there was incongruence between theviews expressed on the role and level ofperformance of internal audit, and theperception obtained by the ANAOthrough discussions with the head ofthe internal audit unit.

GAIN data 0%

10% 20% 30% 40% 50% 60% 70% 80% 90%

100%

Australian Governmen t

never sometimes always

20 Internal Audit

Recommendations

2.53.2.53. It is recommendedrecommended that thehead of internal audit attends all auditcommittee meetings.

2.54.2.54. It is further recommendedrecommendedthat the head of internal audit meetsprivately with the audit committee (orat least the Chair of the committee) atleast as frequently as the auditcommittee itself meets each year.

Implementing the recommendations

2.55.2.55. The private meetings should betaken as an opportunity to discuss thestrategic direction and approach ofinternal audit and to communicate thecommittee’s view of internal audit’sperformance.

Risk focus to meet clientRisk focus to meet clientneedsneeds 2.56.2.56. A relevant and effective internalaudit function will forge a shared visionof its role with its clients and willconcentrate on agreed areas of greatestrisk and on other managementconcerns.

2.57.2.57. To achieve these outcomes,internal audit must involvemanagement in its planning processes.It must also ensure that its plannedactivities are appropriate for theinternal control structure of theorganisation, as part of the corporategovernance framework.

2.58.2.58. The audit found that, whileinternal audit units adopted a risk-based approach to planning, it wasundertaken in isolation from linemanagement and concentrated on

financial rather than all business risks.

PlanningPlanning

2.59.2.59. Internal audit’s primary role is tohelp identify and assess business risk inan organisation. It analyses andevaluates the controls established torespond to identified risks, and reportsthe results to senior management.

2.60.2.60. From this perspective, internalaudit planning must primarily have arisk focus. These risks shouldencompass not simply financial oraccounting risks but all business riskswhich threaten the achievement ofcorporate objectives and programoutputs and outcomes.

2.61.2.61. Such risks may relate to political,reputation, strategic or regulatorycompliance issues.

2.62.2.62. The audit found that themajority of survey respondents (88 percent) indicated they used eitherjudgemental or quantitative riskassessment models to assist in thedetermination of planned audit activity.

2.63.2.63. However, in the detailed auditof selected organisations an uneventreatment of risks was observed.

2.64.2.64. It was noted that the focus ofinternal audit attention remains onfinancial and accounting risks. As aresult, in these organisations, theinternal audit emphasis remained withthe traditional areas of reviewingcontrols over the processing andrecording of transactions.

2.65.2.65. The linkages between internalaudit’s risk assessments and theirstrategic plans were also found to betenuous in a number of organisations.

Detailed Findings and Recommendations

21

2.66.2.66. In such organisations there wasa lack of formal documentation whichrelated identified business risks toplanned internal audit activities.Accordingly, it was difficult to establishwhether the strategic and operationalaudit plans systematically addressed allkey business risks.

2.67.2.67. It was also noted in the surveythat one third of respondents indicatedtheir risk assessments and judgementswere formed without consultation withline management.

2.68.2.68. The impact of this lack ofconsultation revealed itself in the resultsof client satisfaction surveys. Wherethese were undertaken, the surveyedgroup, not surprisingly, performedbelow international benchmarks inrelation to whether internal audit hadeffectively solicited managementconcerns.

2.692.69 . More importantly such clientdissatisfaction extended to a concernthat internal audit had not addressedkey business risks. This observationprovides corroboration for the abovefinding in relation to the linkagebetween risks assessments andplanning - refer Table 1.

Recommendations

2.70.2.70. The ANAO recommendsrecommends , as acritical part of the planning process,that internal audit obtain from linemanagement their views of the keybusiness risks facing the organisation,and solicit their concerns andperspective on the operation of keybusiness processes.

2.71.2.71. It is further recommendedrecommendedthat internal audit develop a systematic,formal approach to planning which

demonstrates clear linkages betweentheir business risk assessments and theirstrategic and operational plans.

Table 1 Client satisfaction ratings

AustralianGovernment

IIA’s GAINdatabase

PlanningPlanning • communicates 4.0 4.1• solicits concerns 3.53.5 4.1• covers business risks 3.5 3.9 F i e ldworkF i e ldwork • informs employees 4.0 4.1• executes timely review 4.0 4.0• uses knowledgeable 4.0 4.1 Report ingReport ing • issues timely reports 3.53.5 3.9• provides significant 3.53.5 4.0 Genera lGenera l • adds value 3.53.5 4.0• shows courtesy / flexibility 4.0 4.4

Source: GAIN survey

Note: ratings are from 1 ‘Poor’ to 5 ‘Excellent’

Implementing the recommendations

2.72.2.72. It is important for internal auditto arrive at its own, independentappraisal of these risks. However, itshould consider carefully any significantdisagreement between its own viewsand those of senior and linemanagement. It should be able toreconcile and adequately explain thesedifferences to the satisfaction of itsclients.

Complementing the controlComplementing the controlstructurestructure

2.73.2.73. As increased emphasis is givento effective corporate governancemodels, senior management betterunderstand their responsibilities withinthe new accountability framework.They also acknowledge that internalaudit’s role is one of confirmation, notownership, of the control structure.

22 Internal Audit

2.74.2.74. In organisations with maturesystems, sound business processes andgood governance arrangementsmisunderstanding of the role of internalaudit is less likely to occur.

2.75.2.75. These organisations have inplace a number of monitoring andreview mechanisms through which thechief executive and management obtainassurance that the control structure isoperating as intended.

2.76.2.76. While internal audit is anintegral part of the assurancemechanism, better practiceorganisations will typically also utiliserisk and control self-assessmentprocesses6, combined withaccountability ‘sign-offs’, andcomprehensive management reporting.

2.77.2.77. The benefits to an organisationof risk and control-self assessmentinclude those referred to above, inparticular, relating to line management‘ownership’ of the control structure.

2.78.2.78. The benefits to internal audit,which generally adopts the role offacilitator, include being able to solicitdirectly management concerns andperceptions of risk in a formalisedsetting.

2.79.2.79. This allows internal audit tofocus on agreed risks and to take intoaccount other monitoring andassurance processes when designing itsown audit program.

2.80.2.80. The surveyed organisations

6 Risk and control self-assessments are generallystructured as facilitated workshops at which seniorand line management agree on business risks, theexposures arising from these risks, and the controlsrequired, or in place, to mitigate the relatedexposures.

indicated that less than 30 per cent ofinternal audit units participated in riskand control self-assessment. Thiscompares unfavourably with the GAINpopulation which is closer to 40 percent.

2.81.2.81. This lower level of participationis also likely to reflect the low level ofuse of such mechanisms byCommonwealth public sectororganisations.

Recommendation

2.82.2.82. It is recommendedrecommended thatorganisations consider the role thatinternal audit could take in theintroduction of risk and control self-assessment techniques, as part of theiroverall governance arrangements.

Internal audit resourcesInternal audit resources 2.83.2.83. The relatively small size of mostpublic sector internal audit units makesit difficult to attract and retain staffwith the knowledge bases and skill setsrequired to provide a comprehensive,value-added auditing service.

2.84.2.84. The audit found the strategicresponse to this challenge by themajority of organisations was to eitherfully out-source, or to co-source,internal audit resources from theprivate sector.

Quantum and cost ofQuantum and cost ofresourcesresources

2.85.2.85. The total annual cost of internalaudit in the surveyed organisations was$25.8 million. This represents an

Detailed Findings and Recommendations

23

average of over $500,000 each. Bycomparison, in the 1989 surveyconducted by the ANAO7 the averageannual cost (in 1989 dollars) was$400,000 per organisation.

2.86.2.86. Eight organisations reported anannual cost in excess of $1 million—oneof these in excess of $ 4 million.

2.87.2.87. As part of the audit the ANAOconsidered a number of measureswhich may be useful as benchmarks.

2.88.2.88. The measures used relate to thecost of each internal audit unit as apercentage of each organisation’s totalexpenditure and total assets; and theratio of internal audit staff to totalemployees - refer Table 2.

Table 2 Resource ratio Category In-house Co-

sourced Out-

sourced All

Expenditure 0.038% 0.038% 0.028% 0.030%

Assets 0.019% 0.022% 0.012% 0.020%

Employees 1:347 1:647 notavailable

1:560

Source: GAIN survey Note: the relative cost of internal audit as apercentage of the total expenditure and thetotal assets of an organisation is lower underfully out-sourced arrangements.

2.89.2.89. While individual circumstancesdictate the extent to which eachmeasure is relevant, such benchmarksnevertheless provide a useful basis forcomparison.

2.90.2.90. The data indicate those internalaudit units that are out-sourced involvethe use of fewer resources than thoseeither fully provided in-house or which

7 Audit Report No. 6, 1990-91, ‘Survey of InternalAudit in the Commonwealth Public Sector’, September1990

use co-sourcing arrangements.

2.91.2.91. The ANAO was not able toobtain reliable estimates of the amountof staff resources used under out-sourced arrangements, or of their salarycosts. It is therefore not possible togauge whether the relatively lower levelof resources used by the out-sourcedgroup correlated to any specific factorssuch as lower levels of coverage ordifferent salary costs.

2.92.2.92. The overall ratio of internalaudit staff to total employees, 1 to 560,has varied little since 1989. At the timeof the previous survey the overall ratiowas 1 to 506.

2.93.2.93. However, there is a markeddifference between co-sourced and in-house organisations. For in-houseorganisations the ratio is 1 to 347,which is closer to the ratios reported bythe then Public Service Board in 19848.

2.94.2.94. It is apparent that the generaldecline in employee numbers and costreductions experienced in the publicsector have not directly translated tothe internal audit function.

2.95.2.95. Given the actual movement inratios over the past nine years it wouldappear that internal audit staffing andtotal costs have gone against thegeneral trend since 1989.

2.96.2.96. This outcome may beconsidered by chief executives and auditcommittees to be an appropriateresponse in a period of significantchange. Greater risks may have arisenas a result of major restructuring,including down-sizing, and the re-engineering of program and service

8 op. cit., Audit Report No. 6, p.3

24 Internal Audit

delivery, often with significantinformation technology implications,requiring strengthening of assurancemechanisms.

Recommendation

2.97.2.97. It is recommendedrecommended that chiefexecutives evaluate whether theresources they apply to internal auditeffectively meet the risk profile of theorganisation as well as complementingthe other relevant review andmonitoring mechanisms in place.

Implementing the recommendation

2.98.2.98. This evaluation should, in part,take into account the cost and resourcebenchmarks referred to in this report.

Skil l and knowledge mixSki l l and knowledge mix

2.99.2.99. The audit considered thequalifications of internal audit staff,where employed by the organisation,and the approach being taken toprofessional development.

2.1002.100 . In our 1989 survey itwas reported that only 43 per cent ofinternal audit ‘professional’ staff heldbachelor degrees or higherqualifications.

2.101. 2.101. In the present survey thisfigure had increased to 73 per cent.This growth is a positive outcomeindicating that organisations arecognisant of the need for appropriatelyqualified audit staff. The figure is alsowell above the international benchmarkfrom the GAIN population which isaround 45 per cent.

2.102.2.102. A counterpoint to thisstatistic is that only 37 per cent ofsurveyed organisations indicated their

head of internal audit had a bachelor’sdegree or higher academic qualification.This compares with a rate of 81 percent in the GAIN population.

2.103.2.103. Further, only half of thesurveyed heads of internal audit heldprofessional audit/accountingqualifications compared with 92 percent in the general GAIN population.

2.104.2.104. Given the critical natureof this position the relatively low level ofaudit/accounting qualifications shouldbe of concern to chief executives andline management.

2.1052.105 . With the exception ofthe key position of head of internalaudit, it appears most organisationsrecognise the importance of havingappropriately qualified internal auditstaff.

2.106.2.106. However, it is notedthat any such recognition does notnecessarily translate fully intoorganisational support for continuingprofessional development activities.

2.107.2.107. The audit foundorganisations are much less likely thanthe general GAIN population tosupport their existing internal auditstaff obtaining appropriatequalifications.

2.108.2.108. They are also half aslikely to pay for membership ofprofessional bodies or to reimbursemembers of professional bodies forattendance at meetings.

2.109.2.109. Finally, training hours perauditor reported for the surveyedgroup averaged 40 hours per annum.While this is consistent with the

Detailed Findings and Recommendations

25

standards set down by the professionalaccounting bodies in Australia, it is incontrast to the GAIN populationaverage of 67.5 hours per annum -refer Chart 2.

Chart 2 Professional developmenthours

Source - GAIN survey

Note: the average number of professionaldevelopment hours per annum is significantly lowerin the Australian public sector.

Recommendations

2.110.2.110. It is recommendedrecommended thatorganisations evaluate theirprofessional development policies inrelation to their internal audit staffprofiles to ensure that the level andtype of training is consistent with thelong-term strategies of the internalaudit unit.

22 .111..111. It is further recommended thatthe chief executive, in consultation withthe audit committee, establishesminimum academic and professionalqualifications for internal audit staff,particularly, for the head of the internalunit.

Implementing the recommendations

2.111.2.111. The desired academic and

professional qualifications could beincluded in work level standards as partof the terms and conditions ofemployment in each organisation’scertified and/or workplace agreements.

Continuous improvementContinuous improvement 2.113. 2.113. In contrast to the previousaudit, with one exception discussedlater, this audit did not directly examineoperational matters such as thecompleteness and appropriateness ofaudit working papers; the level andextent of staff direction; or thetimeliness of review and other qualitycontrol mechanisms.

2.114.2.114. To retain its predominantlystrategic focus, the audit consideredwhat continuous improvementprocesses were being utilised byinternal audit in terms of both theiraudit methodologies and theirmanagement and administration oftasks and resources.

2.1152.115 . The exception referred toabove related to audit reporting, whichis central to the effectiveness of internalaudit and is dealt with in-depth below.

2.116.2.116. The audit found that theapproaches taken to continuousimprovement of audit processes andmeasuring performance effectivenesslag significantly behind internationalbest practices.

Continuous improvementContinuous improvementprocessesprocesses

2.117.2.117. The tools and approachesavailable to obtain relevant data, bothfor measuring internal auditeffectiveness and for use as inputs tocontinuous improvement activities,

Institute of Internal

Auditor's GAIN data

Australian Government

0 20 40 60 80

100

Ave

rage

hou

rs

actual budgeted

26 Internal Audit

range from client satisfaction surveys toexternal peer reviews, benchmarkingand reporting against key performanceindicators or targets.

2.1182.118 . The survey dataindicated a low level of use of any ofthe above approaches to measuringperformance effectiveness or forcontinuous improvement.

2.119.2.119. Less than 40 per centof internal audit units used clientsatisfaction surveys, compared to theiruse indicated by internationalbenchmarks of over 60 per cent.

2.1202.120 . Only 16 per centsurveyed indicated they had an externalquality assurance review undertaken inthe previous three years. This compareswith the relevant internationalbenchmark of slightly more than 25 percent.

2.1212.121 . Performance indicatorswere used by 64 per cent of thesurveyed organisations. The focus ofthese indicators was timeliness andquality of outputs but with littleinformation available on cost-effectiveness.

2.122.2.122. The most often usedtimeliness indicators coveredachievement of the approved auditprogram and completion of audit taskswithin agreed time-frames.

2.123. 2.123. The quality indicators usedmost often included the extent ofacceptance and implementation ofaudit recommendations and the level ofclient satisfaction.

2.1242.124 . Of the 36 per cent oforganisations that did not use

performance indicators, one-fifth statedthey saw little value in their use andone-third had experienced difficultydeveloping useful indicators.

Recommendations

2.125.2.125. The ANAOrecommendsrecommends internal audit unitsdevelop appropriate performanceindicators to measure the cost-effectiveness, timeliness and quality oftheir services and products.

2.126.2.126. It is furtherrecommendedrecommended that ‘in-house’ internalaudit units adopt the use of continuousimprovement tools as a means ofensuring their audit, management andadministrative processes follow betterpractice.

Implementing the recommendations

2.127. 2.127. These performance indicatorsshould be developed after consultationwith senior management and should beendorsed by the audit committee.

2.1282.128 . The better practiceguide issued by the ANAO inconjunction with this audit may beused to benchmark existing practices.

Reporting processesReporting processes

2.129.2.129. The audit report is theprimary communication vehicle forinternal audit. The cycle time from thecompletion of audit fieldwork to theissue of the report is generally regardedto have a critical impact on perceptionsof quality and effectiveness.

2.1302.130 . The cycle time forreporting will be affected by theapproach taken to obtainingmanagement input and feedback on

Detailed Findings and Recommendations

27

the audit findings.

2.131.2.131. All surveyedorganisations indicated they issued adraft report for management reviewand incorporated managementcomments in the final report. Thesignificant majority of organisations (92per cent) also included an executivesummary in the final report.

2.1322.132 . The ANAO view is that theseare ‘best practice’ approaches from theperspective that they adopt a ‘nosurprises’ philosophy which is morelikely to receive the support of linemanagement. Such approaches alsorecognise that the audit report isprepared for a number of differentaudiences with differing informationneeds.

2.133. 2.133. In both the above respectsthe surveyed population were ahead ofrelevant international benchmarks.

2.1342.134 . However, there are anumber of aspects of the reportingprocess which require attention toachieve best practice.

2.135.2.135. Foremost is the timetaken to produce the final audit report.For the surveyed group the averageduration was 38 days. This comparesunfavourably against the internationalbenchmark of 30 days.

2.1362.136 . Closer analysis of theresults for the surveyed organisationsindicated the most commonly occurringreporting duration was in the range 21to 30 days.

2.137.2.137. In fact, the top quartile(the top 25 per cent of surveyedorganisations) were able to achieve areporting cycle time of 14 days or less.

By contrast, the bottom quartilerequired in excess of 50 days. Twoorganisations’ reporting cycle times,from completion of fieldwork to theissue of a final report, were in excess of100 days.

2.1382.138 . The better practiceorganisations were not correlated, forexample, to either the size of theorganisation, the source of internalaudit resources (in-house of out-sourced), or with the percentage of thetotal auditing time taken for reporting(average 20 per cent).

2.1392.139 . As all surveyedorganisations adopt the same approachto reporting, and given the lack ofcorrelation referred to above, it isconsidered that 14 days is anappropriate benchmark for allorganisations.

2.1402.140 . On this basis, 75 percent of internal audit units fall belowsuch a benchmark.

2.141.2.141. The impact of the lackof timeliness in reporting is observed inthe results of client satisfaction surveys.Where these were used, internal auditunits were rated, on average, below theinternational GAIN population for thetimeliness of their reports.

Recommendation

2.142.2.142. It is recommendedrecommendedthat those internal audit units withreport cycle times in excess of 14 days,and in particular those in excess of 30days, benchmark their processes againstbetter practice organisations todetermine how best to reduce theircycle times.

28 Internal Audit

Implementing the recommendation

2.1432.143 . The effective use oftechnology, for example e-mail, cansignificantly reduce lag times forreceiving and incorporatingmanagement comments and fordistribution of the final report.

Canberra ACT P. J. Barrett28 May 1998 Auditor-General

29

Part Three

Appendices

Internal Audit 30

Appendix 1Appendix 1

Better practice principles and audit criteriaBetter practice principles and audit criteria

The role of internal audit is changing.As organisations build moresophisticated governance frameworks itis incumbent on internal audit to adaptto the new challenges andopportunities presented by thesedevelopments.

This will require a fundamentalreassessment of the strategic directionand approach of internal audit—a movefrom its traditional ‘policing’ role tomore of an independent adviser.

Accordingly, the principles used for theaudit and the better practice guideaddress the fundamentals of theinternal audit practice—they provideinsights into the strategic direction andfocus of a modern internal auditpractice.

They represent basic elements which, ifnot employed, will significantly hinderany attempt by an internal audit unit tore-engineer itself.

The principles developed revolve aroundthe relationship of the internal auditunit with its key stakeholders, that is,the chief executive, audit committeeand its audit clients.

They also address the planning,monitoring and review processes usedby internal audit itself to ensure that itsapproach to auditing, and themanagement and administration of itsown activities accord with betterpractice.

Each principle is outlined below. Amore detailed treatment is provided in

the better practice guide which hasbeen developed in conjunction withthis audit.

Management support andManagement support andauthorityauthority

It is generally accepted that to beeffective the internal audit functionmust have full support of the executiveand senior management of anorganisation.

In a report on Internal Auditundertaken by the Canadian Auditor-general in 19969 it was observed that‘probably no single factor is moreimportant to effective internal auditthan the attitude and expectations of[executive management]’. That auditfound ‘a strong correlation betweenthose departments with strong seniormanagement support and directionand the effectiveness of the internalaudit function’.

Indicators of the extent of managementsupport reviewed in this audit included:

♦ the existence of a comprehensive,contemporary internal audit charter;

♦ reporting and administrativerelationships between internal audit,the chief executive and the auditcommittee; and

♦ the extent and nature of formal andprivate meetings between the headof internal audit and the chief

9 Chapter 4, Report of the Auditor-General ofCanada, May 1996.

Appendices

31

executive and/or the chair of theaudit committee.

Risk focus to meet cl ientRisk focus to meet cl ientneedsneeds

The role of internal audit may varybetween organisations depending onthe particular circumstances of each.

The more ‘traditional’ approach oftesting for and reporting on the degreeand extent of compliance withprescribed control procedures may beappropriate where an organisation hasbeen through a period of rapid change.

In those organisations with moremature business systems, and thosewith sound assurance and reviewmechanisms established as part of theiroverall corporate governancearrangements, internal audit may take amore pro-active role in monitoring andreporting on systems design, evaluationand implementation activities.

Irrespective of the role determined forinternal audit by the chief executive, aconstant underlying principle is thatinternal audit should focus on criticalbusiness processes and high risk areas.

This will ensure that internal audit’sactivities remain relevant to client needsand that its findings andrecommendations are relevant toorganisational success.

The audit considered the followingfactors in evaluating performanceagainst this criterion:

♦ the nature of and extent to whichindependent risk assessments wereundertaken by internal audit informulating the audit plan;

♦ the extent and nature ofinvolvement of executive and linemanagement in the audit planningprocess; and

♦ the degree to which internal auditplans and activities complementedother monitoring and reviewassurance processes, including riskand control self-assessment.

Skil ls and qualif ications ofSkil ls and qualif ications ofstaffstaff

The audit profession has clearly definedstandards for the knowledge bases andskill sets required of professionalauditors.

An evaluation of the competencies ofinternal audit resources must take thesefactors into account. However, thequalifications, training and backgroundof internal audit staff will not berestricted to auditing or accounting.

The overall resources utilised for theinternal audit function should reflect anappropriate mix of knowledge and skillsrelevant both to the context of theoperations and business of eachorganisation, and to the role of internalaudit within the organisation.

In particular, it could be expected thatinternal audit will seek to obtainresources with expertise in the businessprocesses of the organisation or inbusiness processes generally. It mayalso require access to specific technicalknowledge and operational expertise.

These demands present a significantchallenge to small internal audit units,where the particular expertise orknowledge is required only periodically.

32 Internal Audit

In evaluating whether internal audit had achieved the appropriate balance

of skill and qualifications the auditconsidered the following:

♦ the remuneration and professionaldevelopment policies for internalaudit staff;

♦ the academic and professionalqualifications of internal audit staff;and

♦ the extent and nature of‘contracting’ of specialist staff fromoutside or within the organisation(eg. through secondment).

Continuous improvementContinuous improvement

Internal audit processes, both technicaland administrative, in common with allother business processes, should besubject to ongoing monitoring, reviewand evaluation.

Perhaps the most critical process interms of the actual and perceivedquality and effectiveness of internal

audit is reporting. The audit report isthe primary communication vehicle. Itmust effectively communicate findingsand present practical recommendationswith realistic time frames forimplementation.

In evaluating this process the auditconsidered:

♦ cycle times to produce reports; and

♦ the extent of acceptance andimplementation of auditrecommendations.

The audit also examined the othermechanisms used by the organisationand by internal audit to evaluate itsperformance effectiveness, includingthe use of client surveys, benchmarking,external reviews and the developmentand review of appropriate performanceindicators and targets.

Appendices

33

Appendix 2Appendix 2

About the auditAbout the audit

BackgroundBackground

In 1989 the ANAO surveyed theperformance and managementperceptions of internal audit andrevealed that although internal auditwas well established in theCommonwealth public sector andenjoyed the support of management, itdid not always provide managementwith relevant and appropriate advice.The survey also found that a gap existedbetween service levels expected ofinternal audit by management and theservice provided.

In the following year the ANAOundertook a follow-up efficiency auditof internal audit in eightCommonwealth entities whichidentified specific policies, proceduresand practices necessary for improvingthe efficiency and effectiveness ofinternal audit. These findingsculminated in the publication, in March1993 of A Practical Guide to PublicSector Internal Auditing.

Five years on, and in light ofconsiderable legislative and operationalchanges within the APS, the ANAO hasundertaken a benchmarking study andfollow-up financial control andadministration audit:

♦ on the effectiveness of internalaudit; and

♦ to identify public sector internalaudit better practice.

Benchmarking StudyBenchmarking Study

The first step involved the completionof a benchmarking study using theGAIN questionnaire. The GAIN surveywas developed by the Institute ofInternal Auditors as a service to itsmembers. It is a benchmarkingdatabase of responses to detailedquestions about internal audit activities,costs and methodologies from between600 and 700 internal audit unitsaround the world.

The ANAO supplemented the GAINquestionnaire with a number ofquestions specific to the requirementsof the audit and provided the twoquestionnaires to 50 selectedorganisations in September 1997.

The survey respondents, 49 in total,expended $25.7 million on InternalAudit services, for the period ended 30June 1997.

They had total expenditures of $68.2billion, revenues of $142 billion andassets of $126 billion. They employed atotal of 205,000 staff.

The survey included organisations within-house, contracted-out (out-sourced)and mixed (co-sourced) internal auditresources.

Twelve respondents, or 24 per cent,provided a totally in-house internalaudit service, seventeen respondents, or35 per cent, relied solely on contractorsfor the function and the remaining

34 Internal Audit

twenty, or 41 per cent, used a mix ofin-house and contract resources.

Those organisations with in-house orco-sourced arrangements (29 in total)employed 355 internal audit staff, anaverage of 12 staff. This compareswith 866 staff employed by 50 ‘in-house’organisations surveyed in 1989, anaverage of 17 staff.

The results of the survey wereprocessed and compared with theresults from all organisations includedin the Institute’s GAIN database.

A detailed analysis of the results wasproduced and provided, in January1998, to all organisations whoparticipated in the survey.

A more general ‘Benchmarking Report’analysing the overall results for theAustralian Commonwealth public sectorwas produced in February 1998 andforwarded to all ‘general government’organisations.

The results from the benchmarkingstudy, and the results from individualsurveys, have been incorporated intothis Report where appropriate.

FCA AuditFCA Audit

The ANAO followed the survey with adetailed FCA audit on the internal auditoperations of 12 public sectororganisations. The audit commenced inJanuary 1998.

Audit Objectives

The objectives of the audit were toassess the role and effectiveness ofinternal audit operations in the APS andto promulgate better practice identifiedfor the function.

Audit Evaluation Criteria

The audit sought to confirm the validityof the survey responses and undertooka more detailed review of the quality,quantity and cost effectiveness ofinternal audit operations.

The audit evaluated internal audit unitsagainst the following four keyprinciples:

♦ obtaining appropriate managementauthority and support;

♦ adopting a risk-focused approachto meet client and organisationalneeds;

♦ getting the right mix of skills andqualifications; and

♦ seeking continuos improvements inaudit and administrative practices.

During the audit the ANAO met withthe Chairs of the Audit Committees ofmost of the organisations reviewed.The ANAO also met with staff frominternal audit and reviewed a selectionof relevant documentation against thecriteria outlined above.

Performance InformationPerformance Information

The total cost of the field work phase ofthe audit and production of the betterpractice guide is estimated to be$455,000. The average cost of thefieldwork at each of the 12organisations reviewed was $15,000.

The total cost of the survey phase of theaudit was $156,000. This includes acost of $76,000 (US$49,000) for theGAIN survey of 49 agencies. The surveyextends over a three year period to1998-99.

Appendices

35

A total of 23 recommendations weremade in relation to the findings arisingfrom the fieldwork in eachorganisation.

Planning for the audit commenced inAugust 1997. The survey wasundertaken in October/November 1997and reported in January/February.

Fieldwork in selected agenciescommenced in January 1998 and wascompleted in April 1998.

The total time elapsed fromcommencement of planning to tablingof the audit report was 9 months.However, this includes thebenchmarking survey.

The field audit was completed in fivemonths which is within the six monthbenchmark used by the ANAO as aperformance measure of the timelinessof reporting FCA audits.

Internal Audit36

Series Titles

Titles published in the financial year 1997-98

Audit Report No.1Audit Activity Report: Jan-Jun 1997Summary of Audit Outcomes

Audit Report No.2 Performance AuditGovernment Business EnterpriseMonitoring PracticesSelected Agencies

Audit Report No.3 Performance AuditProgram Evaluation in the AustralianPublic Service

Audit Report No.4 Performance AuditService Delivery in Radio andTelecommunicationsAustralian Telecommunications Authorityand Spectrum Management Agency

Audit Report No.5 Performance AuditPerformance Management of DefenceInventoryDefence Quality Assurance (preliminarystudy)

Audit Report No.6 Performance AuditRisk Management in CommercialComplianceAustralian Customs Service

Audit Report No.7 Performance AuditImmigration Compliance FunctionDepartment of Immigration andMulticultural Affairs

Audit Report No.8 Performance AuditThe Management of OccupationalStress in Commonwealth Employment

Audit Report No.9 Performance AuditManagement of TelecommunicationsServices in Selected Agencies

Audit Report No.10 Performance AuditAspects of Corporate GovernanceThe Australian Tourist Commission

Audit Report No.11 Performance AuditAUSTUDYDepartment of Employment, Education,Training and Youth Affairs

Audit Report No.12 Performance AuditThe Pharmaceutical Benefits SchemeDepartment of Health and FamilyServices

Audit Report No.13 Performance AuditThird Tranche Sale of theCommonwealth Bank of Australia

Audit Report No.14 Financial Control andAdministration AuditOfficial Travel by Public SectorEmployees

Audit Report No.15 Financial Control andAdministration AuditInternet Security Management

Audit Report No.16 Performance AuditEquity in Employment in the AustralianPublic ServicePSMPC and other agencies

Audit Report No.17 Performance AuditSydney Airport Noise AmeliorationProgram

Series Titles

37

Department of Transport and RegionalDevelopment

Audit Report No.18 Performance AuditManagement of the Implementation ofthe New Commonwealth ServicesDelivery ArrangementsCentrelink

Audit Report No.19 Performance AuditRisk Management in ATO SmallBusiness IncomeAustralian Taxation Office

Audit Report No.20 Performance AuditSales TaxAustralian Taxation Office

Audit Report No.21 Financial Control andAdministration AuditProtective Security

Audit Report No.22 Financial Control andAdministration AuditAudits of the Financial Statements ofCommonwealth Entities for 1996-97Summary of Results and Outcomes

Audit Report No.23 Performance AuditMinisterial Travel Claims

Audit Report No.24 Performance AuditMatters Relevant to a Contract withSouth Pacific Cruise Lines LtdDepartment of Employment, Education,Training and Youth Affairs

Audit Report No.25 Performance AuditGun Buy-Back SchemeAttorney-General’s Department

Audit Report No.26 Performance AuditStrategic and Operational ManagementNational Registration Authority forAgricultural and Veterinary Chemicals

Audit Report No.27 Performance AuditManaging the Year 2000 ProblemRisk Assessment and Management inCommonwealth Agencies

Audit Report No.28 Performance AuditContracting Arrangements for AgenciesAir Travel

Audit Report No.29 Financial Control andAdministration AuditManagement of Accounts Receivable

Audit Report No.30 Performance AuditEvaluation Processes for the Selectionof– Records Management Systems– Internet Access Servicesfor the CommonwealthOffice of Government InformationTechnology

Audit Report No.31 Financial StatementAuditAggregate Financial Statementprepared by the Minister for Financeand AdministrationYear ended 30 June 1997

Audit Report No.32 Performance AuditThe Management of Boat PeopleDepartment of Immigration andMulticultural AffairsAustralian Protective ServiceAustralian Customs Service -Coastwatch

Audit Report No.33 Performance AuditCommonwealth Management of theGreat Barrier ReefGreat Barrier Reef Marine Park Authority

38 Internal Audit

Audit Report No.34 Performance AuditNew Submarine ProjectDepartment of Defence

Audit Report No.35 Performance AuditDEETYA International ServicesDepartment of Employment, Education,Training and Youth Affairs

Audit Report No.36 Performance AuditAudit Activity ReportJuly to December 1997Summary of Outcomes

Audit Report No.37 Performance AuditProtection of Confidential Client Datafrom unauthorised DisclosureDepartment of Social SecurityCentrelink

Audit Report No.38 Performance AuditSale of Brisbane Melbourne and PerthAirports

Audit Report No.39 Performance AuditManagement of Selected Functions ofthe Child Support Agency

Australian Taxation Office

Audit Report No.40 Performance AuditPurchase of Hospital Services fromState GovernmentsDepartment of Veterans’ Affairs

Audit Report No.41 Financial Control andAdministration AuditAsset Management

Audit Report No.42 Preliminary InquiryPreliminary Inquiries into the NaturalHeritage Trust

Audit Report No.43 Performance AuditLife-cycle Costing in Department ofDefenceDepartment of Defence

Audit Report No.44 Performance AuditThe Australian DiplomaticCommunications Network – ProjectManagementDepartment of Foreign Affairs and Trade