Q&A: You asked us - November 2022
Q Do you have any guidance on standards when procuring internal audit services to undertake the full annual audit programme?
A There is no recommended formula within the International Professional Practices Framework (IPPF) to draw on to ensure an effective internal audit function and we are often asked about the pros and cons of different models. Have a look at the case studies included with the “Models of effective internal audit” page and at our technical blog on “Buying in resources to supplement internal audit skill sets”.
These outline some of the pros and cons of different delivery models for internal audit and should help you to define the internal audit service you need.
ICAS also provides food for thought when considering outsourcing internal audit.
In addition, consider the requirement for an EQA (Standards 1312 – External Assessment). This is particularly important if you’re looking to outsource the internal audit function. It is advisable to insert in the tender process a requirement for any interested party to provide evidence of a recent EQA – within the past three to five years. Have a look at the IA Performance Report 2020-21, which summarises the EQAs that the Chartered IIA undertook in 2020-2021, since this provides a SWOT analysis of common themes and will suggest questions to ask potential suppliers.
IIA Global released a position paper in 2018 called “Staffing/Resourcing Considerations for Internal Audit Activity”, and this includes key takeaways, five essential questions to ask, and considerations for evaluating outsourcing alternatives, which may also be helpful.
Q We currently have vacancies in our internal audit function and are finding it harder to fill them than in the past. From your knowledge of what’s happening in the industry, are there some key things we should be thinking about to attract applicants?
A The CIPD Labour Market Outlook recently reported that 78 per cent of employers with vacancies consider them “hard to fill”. Unemployment is currently at 3.6 per cent (the lowest rate since 1974) so you’re not alone. However, the Bank of England is predicting a recession from the fourth quarter of 2022 and job vacancies are falling, so supply may return to normal over the next year or so.
In the meantime, you could think about:
• upskilling existing staff;
• raising wages;
• hiring more apprentices;
• improving job quality – for example, offering more flexibility (this has become an expectation rather than a perk).
Staff retention is as important as recruitment. Oxford Economics has published research that suggests it takes 28 weeks for professional workers to reach optimum productivity – which costs £25,200. Therefore, even if you recruit senior, experienced people, you will lose productivity and incur costs. Make sure that the salaries you offer are close to the market rate and that your benefits package incorporates physical and mental wellbeing as well as, of course, job satisfaction.
The cost of providing these elements may be easier to manage than increasing salaries, so investigate what you can offer before you recruit new people. The Risk 2022 Overview “Human Capital, Diversity and Talent Management” provides useful areas to consider and our technical guidance on Talent Managementcould also help.
Q We are about to start an audit of diversity and inclusion. Do you have any resources that could help us to scope the work?
A Useful guidance from IIA Global on diversity and inclusion is on our website.
• Understanding the Effects of Diversity and Inclusion on Organizations.
• Diversity, Equity, and Inclusion (DEI) 101: Internal Audit’s Invaluable Role in Creating a Sense of Belonging at Work.
In addition, our Risk 2022 Overview “Human Capital, Diversity and Talent Management” includes information on diversity and inclusion. We have also recently published technical guidance on psychological safety, which should be considered as part of your audit.
These resources outline useful definitions, show how internal audit could add value in this space and the organisational benefits of
effective diversity and inclusion policies and activities.
As always, be mindful of legal requirements and best practice around diversity and inclusion when setting the scope for assurance work. Sources of information, such as those from ACAS, will help.
Q I understand that the Modern Slavery Act 2015 is being amended. As a local authority, we are currently exempt from reporting on modern slavery. Is this likely to change and what are the key things we should be doing and/or preparing for?
A The Modern Slavery Act 2015 does not currently oblige local authorities to publish Modern Slavery and Human Trafficking statements, but this is set to change. The government has announced that public sector organisations, including councils and fire and rescue services with a budget of £36m or more, will be included in the amended provisions of The Modern Slavery Act. This was originally scheduled to come into effect in 2021, but no new date has yet been set.
Local authorities are currently required to report children and consenting adults who are potentially involved in modern slavery. Some local authorities already provide a Modern Slavery and Human Trafficking statement on their website. This is good practice and offers transparency. It is likely that the amended legislation will require more detailed narrative in the statement.
If you wait until amended legislation comes into force before you start to report, you’ll need to hit the ground running. It will take time and effort to put this into effect, including implementing policies and processes, but you could start by initiating conversations about what the organisation should be doing.
Talk to your organisation about the policies and procedures already in place to prevent modern slavery and deliver awareness training. It takes time to change behaviour. You should already have whistleblowing forums with formal responses to modern slavery cases. Your organisation must understand what it needs to put in place to help people understand this complex issue.
The statement will require approval and sign off at the highest level in the organisation. For local authorities, this will be the CEO and the leader of the council. It will need to be published on your website and reviewed and updated annually as appropriate. The legislation also states that it should be prominent and accessible.
Internal auditors need to ask:
• How can we get ahead of the curve and help organisations?
• Are there reviews and controls in place?
• Where is modern slavery on the audit plan?
Understanding modern slavery risks across all tiers in your organisation’s supply chain is also key. Organisations that use the same suppliers could share the burden of investigating these. It may also help to start by selecting one department for an audit of modern slavery and to start there – for example, procurement or social services – and then to roll out audits in different parts of the organisation.
We recently held a Local Authority Forum session on modern slavery and the key takeaways and slides from the session are on our website. We also have two pieces of technical guidance on Modern Slavery that will be useful.
• Modern Slavery and Human Trafficking annual statements.
GOT A QUESTION? Contact the Chartered IIA technical helpline on 0845 883 4739 or email technical@iia.org.uk
This article was published in November 2022.