Internal Audit

Capability Model
(IA-CM)
for the Public Sector
Using the IA-CM as a
Self-assessment Tool

IA-CM

www.theiia.org/research
 IA-CM
Agenda
• What is the IA-CM?
– Underlying principles.
• Structure of the IA-CM.
• Self-assessment steps.
• Considerations.
• Communicate results.
• More information.

www.theiia.org/research
 IA-CM
What is the IA-CM?

• Communication vehicle.

• Framework for assessment.

• A road map for orderly

improvement.

www.theiia.org/research
 IA-CM
Why Public Sector?
• Internal auditing (IA) varies widely from
country to country.
• Differences in culture, management
practices, and processes.
• Need for a governance model, including IA.
• Opportunities to:
– Modernize/evolve IA.
– Improve its effectiveness.
– Deliver added value.
• Critical need for a developmental model,
especially in developing countries.
4

www.theiia.org/research
 IA-CM
Underlying Principles

IA Activity’s Obligations
• Be an integral component of effective
governance in the public sector.
• Help organizations achieve their objectives
and account for their results.

Organization’s Obligations
• Determine optimum level of IA capability to
support required governance structures.
• Achieve and maintain the desired capability.
5

www.theiia.org/research
 IA-CM
Underlying Principles

Selecting Optimum Capability

• Three variables:
– Environment.
– Organization.
– IA activity.
• Different capability required.
• Auditing must be cost-effective.
• No “one size fits all.”
6

www.theiia.org/research
 Structure of the IA-CM
Capability
CapabilityLevel
Level

Key Key
KeyProcess
ProcessArea
KeyProcess
ProcessArea
Area Area Key
KeyProcess
ProcessArea
Area

Purpose

Activities
Activities

Outputs
Outputs&&
Outcomes
Outcomes

Mastery
Mastery

www.theiia.org/research
 IA Capability Model IA-CM
Levels
IA learning from inside and outside the LEVEL 5
organization for continuous improvement Optimizing

IA integrates information from across the organization LEVEL 4

to improve governance and risk management Managed

IA management and professional LEVEL 3

practices uniformly applied Integrated

Sustainable and repeatable IA LEVEL 2

practices and procedures
Infrastructure
No sustainable,
repeatable LEVEL 1
capabilities –
dependent upon
Initial
individual
efforts

www.theiia.org/research
 IA-CM
Why Levels?

• Different performance expectations and

measures in current practice.
• Capability gets built in steps/stages.
• Need a common map/conceptual
framework.
• Help select the capability level
appropriate for an organization.

www.theiia.org/research
 IA-CM
IA Activity Elements

The IA activity consists of the following

six elements:
– Services and role of IA.
– People management.
– Professional practices.
– Performance management and
accountability.
– Organizational relationships and culture.
– Governance structures.
10

www.theiia.org/research
 Internal Audit
IA-CM
Capability Model Matrix
Services and Role of IA People Management Professional Practices Performance Organizational Governance
Management and Relationships and Structures
Accountability Culture

Level 5 –Optimizing Leadership Involvement with Continuous Improvement

IA Recognized as Key Professional Bodies in Professional Practices Public Reporting of IA Effective and Ongoing Independence, Power,
Agent of Change Effectiveness Relationships and Authority of the IA
Workforce Projection Strategic IA Planning Activity

Level 4 – IA Contributes to Independent Oversight

Managed Overall Assurance on
Governance, Risk
Management, and Control
Management Development
IA Activity Supports
Professional Bodies
Audit Strategy Leverages Integration of Qualitative CAE Advises and of the IA Activity
Organization’s and Quantitative Influences Top-level
Management of Risk Performance Measures Management CAE Reports to Top-
level Authority

Workforce Planning

Level 3 – Integrated Team Building and Competency Quality Management Performance Measures Coordination with Other Management Oversight
Advisory Services Framework Review Groups of the IA Activity
Professionally Qualified Staff Cost Information
Performance/Value-for- Risk-based Audit Plans Integral Component of Funding Mechanisms
Money Audits Management Team
Workforce Coordination IA Management Reports

Level 2 – Individual Professional Professional Practices and Full Access to the

Infrastructure Compliance Auditing Development Processes Framework IA Operating Budget Managing within the IA Organization’s
Activity Information, Assets, and
People
Skilled People Identified and Audit Plan Based on IA Business Plan
Recruited Management/
Stakeholder Priorities Reporting Relationship
Established

Level 1 – Ad hoc and unstructured; isolated single audits or reviews of documents and transactions for accuracy and compliance; outputs dependent upon the skills of specific individuals holding
the position; no specific professional practices established other than those provided by professional associations; funding approved by management, as needed; absence of
Initial
infrastructure; auditors likely part of a larger organizational unit; no established capabilities; therefore, no specific key process areas
11

www.theiia.org/research
 IA-CM
Using the IA-CM

• Not prescriptive — what should be

done rather than how to do it.
• A universal model with
comparability around principles,
practices, and processes to
improve IA and be applied
globally.
12

www.theiia.org/research
 Self-assessment IA-CM
Steps
• Understand the IA-CM.
• Identify KPAs that appear to be
institutionalized by the IA activity.
• Review documentation re: IA activity,
organization, and environment.
• Interview managers/stakeholders.
• Confirm actual KPAs institutionalized.
• Determine capability level.
• Communicate results.
13

www.theiia.org/research
 IA-CM
Considerations

• Apply professional judgment.

• Consider environmental and
organizational factors.
• Is Level 3 sufficient?
• Can capability levels be skipped?
• Can KPAs be ignored?
• Must all elements be at the same
capability level?
14

www.theiia.org/research
 IA-CM
Communicate Results

• Identify strengths and areas for

improvement of the IA activity.

• Identify “leading practices” of the

IA activity.

15

www.theiia.org/research
 Internal Audit
Capability Model
(IA-CM)
for the Public Sector

For more information, visit:

www.theiia.org/research/ia-cm

IA-CM

16

www.theiia.org/research