Q&A: You asked us - January 2024

Q: As part of my personal development, I will be starting to lead audits. Until now I’ve always been a support resource and I’m feeling a bit daunted. Is there any guidance that could help me? 

A: First, congratulations on progressing your career. The responsibilities of leading an internal audit vary in different internal audit functions. Our guidance covers a variety of skills so you can pick those most appropriate for your needs.

Under the Resources tab on our website you will find sections for technical skills, interpersonal skills and leadership. Within “technical”, for example, there is guidance to help at each stage of the audit process, so, for instance, you can find help with scoping if that is new to you. Within “interpersonal”, you will find tips to help with difficult conversations and coaching – areas that you will find yourself doing with team members.

Q: I am thinking about studying for a formal internal audit qualification, but I’m not sure which one to do now that the Standards are changing. Can you help?

A: The Professional Standards are changing from the IPPF (International Professional Practices Framework) to the new Global Internal Audit Standards, but this should not stop you pursuing an internal audit certification. There will be a clear transition path for students and we will keep things as simple as possible. Take a look at our Career Pathway and talk to studentsupport@iia.org.uk for more information.

Q: We are introducing assurance mapping and would welcome advice. One of the areas that is challenging us is what assurance should go to the board? In principle, is it appropriate for the first line to report directly, or should their assurance only be to the second line?

A: An assurance map is a tool that can add real value to the board. You raise a common challenge as the process of documenting assurance can reveal duplication, gaps and also sources of information that were previously unknown.

Helping the board to decide which assurance to receive directly is an important part of the process. The design of the assurance map should help to identify which assurance is key to the risks, regardless of its source. It may take a while to achieve your goal of providing consistent and meaningful information for decision-making. At the outset, it may be useful to report through the second line and then, as maturity develops, the first line may be able to report directly, for example, via integrated dashboards. We have produced a simple blog outlining five steps to creating an assurance map and IIA Global has produced more in-depth guidance.

Q: Is there any guidance on performing change assurance? I am looking for a framework to use to provide a consistent approach.

A: 1nternal auditors fulfil their assurance and advisory role in a variety of ways for projects/change programmes. These may include:

• validating business cases as projects begin;
• determining whether projects are “set up for success”;
• looking at whether project risk management and action tracking is effective;
• looking at the effectiveness of project/programme management teams;
• looking at project cost management;
• examining the design of new processes;
• being involved in user acceptance testing;
• doing due diligence ahead of “go live” decisions;
• validating benefits calculations;
• advising on steering groups;
• facilitating “lessons learned” workshops.

The Chartered IIA has published several pieces of guidance on this topic. The relevance of these will depend on the scope of your work.

In terms of a framework, the Association for Project Management has published a toolkit you may find useful. You could also benefit from studying the Government Service Standard, which offers a practical guide.

This article was published in January 24.