Will CFIA Transform Internal Auditing

Articles on Internal Auditing

Will CFIA Transform Internal Auditing?

The following article first appeared in the May/June 98 edition of IIA Today, published by The Institute of Internal Auditors. Used with Permission.

For more than two years, a research team has been interviewing, reading, surveying, studying, and culling information from around the globe about the internal auditing profession and its required competencies. Under the auspices of The Institute of Internal Auditors Research Foundation, the team set out to discover and define a competency framework for internal auditing. Their research was constructed to incorporate a global perspective, a future perspective, a best-practices perspective, and a competency perspective. The results of their efforts will culminate in the publication of Competency Framework for Internal Auditing (CFIA), to be released this summer.

The CFIA (pronounced “Sofia”) project is divided into six separate but interrelated modules, all of which have a common purpose: to find the “essence” of the global profession of internal auditing. Researchers designed the studies around the following four questions:

What is internal auditing today and what will it be in the future?
What are the attributes of a competent internal auditing function from a best-practices perspective?
What capabilities should be required by those in a competent internal audit function?
How is the competency of internal auditors and an internal audit function best assessed?

Each module was approached from a different perspective, drawing input from different sources and utilizing different methodologies—thereby providing cross-validation for the study’s findings. The researchers believe their final report will alter the internal auditing profession as many understand it today.

A New Definition

A significant finding of the study deals with the need for a universal definition of the profession. Associations worldwide reported that a great deal of uncertainty exists about the total number of practicing internal auditors, partly because of variations in the internal auditing definition around the globe. This lack of definition also hampers management’s’ understanding of, and respect for, the profession and its practitioners. Based on his team’s research, CFIA Project Director Bill Birkett has presented the following competency-based definition of internal auditing: “Those organizational processes instituted to provide assurance that risk exposures are understood and managed appropriately, in the midst of ongoing and dynamic change.”

This definition, with its focus on risk, is derived from CFIA’s research results. According to the Internal Auditing Knowledge: Global Perspectives module, organizations are seeking to establish overarching forms of assurance that their business risks are managed appropriately, in real time, and proactively. Internal auditing, conclude researchers, is being repositioned in a broad mechanism for providing assurance about risk and its management within an organization.
“Organizations need assurance that they are in control while they continuously change their risk profiles with such moves as joint ventures and new product or service lines,” Birkett said. “Organizations are moving toward an ideal procedure where they will review and seek assurance for their risk exposure in totality. Thus, areas that previously were viewed as separate in terms of risk management—quality assurance, environmental management, occupational health and safety, and internal auditing—are likely to be amalgamated in ways that may not now be completely understood, but are being experimentally reviewed.”

Identifying Competencies

In addition to coining a definition for the profession, researchers sought to identify the core competencies that practitioners should possess to perform their duties successfully. The competency standards developed in the CFIA study are expected to help internal auditing customers understand the nature of the service they receive and to evaluate its quality. Internal auditing managers may rely on these competencies to assess the structures, capabilities, and functioning of their departments, and practitioners may use them to assess the contributions they make to departmental work and their own developmental
needs.

“I think the competency aspects of the Competency Standards in Internal Auditing module will contribute significantly to the advancement of the profession,” said Dave Kowalczyk, chairman of the Research Foundation’s board of research advisors. “There is also great potential for The IIA to create knowledge-based training programs and for academicians to focus internal audit offerings at universities.”

Bill Duane agrees that the results from the investigations into core competencies will have a profound effect. “For the first time, it’s clear that our competencies have to change, grow, and expand,” said Duane, who is president of the Research Foundation. “The researchers partition the internal auditing career into three key levels—entering internal auditor, competent internal auditor, and internal auditing manager—each with its own set of skills. “This confirms that an internal auditor’s development is truly evolutionary,” Duane said. “In the future, I believe the CIA exam will likely be revised to reflect and measure some of these competencies.”

Addressing the Issues

Most project reviewers concur that the research will bring issues to the forefront that may have been previously brushed aside. For example, researchers state that there will no longer be a place in organizations for a constant, independent appraisal function, because it’s not perceived as a value-adding activity. “Instead,” said Birkett, “assurance about value creation and risk management becomes a normal part of the management process, and risk management and assurance will be considered a dimension of management. Under these circumstances, internal auditing disappears into the management process.”

Duane agrees that the roles of internal auditors will be more multidimensional, but will remain organizationally independent and objective. “We will have to be perceived by management as consultants,” he said. “The IIA needs to revisit the whole topic of independence, particularly in the Standards, because the concept will change as internal auditors strive to add value and be management’s consultant.”

Outsourcing, another issue dogging the profession, “will simply disappear,” said the researchers. “Because the assurance function in organizations will become an integral part of management in the future, there will be no need for a separate function to exist outside of management,” Birkett said. “The issue will be to choose selectively the core competencies and other resources that will provide continual value creation for the organization.”

Workplace assessment is another issue likely to cause a stir throughout the profession. “It’s an interesting concept that I never thought about until this study,” said Ray Whittington, director of the School of Accountancy at DePaul University. “Certain competencies cannot be adequately assessed by written examination.” According to researchers, future CIA exams might be designed to provide an independent check of the knowledge and cognitive skills required to perform internal auditing services, while workplace assessment will focus on the effective performance of roles. Washington claims that, eventually, workplace assessment could be used in conjunction with the CIA exam to evaluate behavioral attributes, such as oral communication.

Looking Forward

The Future in Internal Auditing: A Delphi Study elicits and consolidates the opinions of internal auditing experts from around the world on what internal auditing will be like in the future—the skills required to perform the key tasks of internal auditing and the set of knowledge required to perform the tasks. Researchers conclude that the culture of internal auditing should be one that welcomes change as an opportunity, thrives on challenge, and prizes responsiveness to organizational needs. According to the module, internal auditing will provide advice, promote understanding, facilitate change, and sponsor continuous improvement in addition to its traditional role of providing assurance. Also, the scope of internal auditing work will reflect the nature and needs of the organization.

The reviewers for the CFIA study, which include members of the board of research advisors, the board of regents, and various committee representatives, are optimistic about the global aspects of the entire research project—particularly the results of the Delphi Study. Criticisms of the module have been few, although one reviewer did express a concern about the module’s methodology, which assumes that experts in the field, individually and collectively, are in the best to identify future developments. The reviewer pointed out that CEOs, CFOs, and audit committee members were not included in the universe of experts, and that consulting the users of internal audit services might have added a meaningful and significant dimension to the study.

However, James Thompson, manager of The IIA’s Research Department, points out that the customer was represented, if only indirectly. “The Delphi Study was sent to thought leaders within the internal auditing profession who typify best-practice behavior,” he said. “Key among the best practices in this profession is an awareness of the needs and perspectives of the customer. As such, the study’s predilection does include an appreciation of the internal audit customer’s needs.”

Heavy and High-Level

According to Birkett, the project’s six modules and research outcomes can be used in benchmarking practices, as a development resource, for facilitating global communications, and in framing internal auditing learning and development. “This document is incredibly comprehensive,” Duane said. “It’s heavy, both in terms of volume and in terms of the implications of the findings. I believe anyone who reads it will find the information to be of real value to his or her career, profession, and organization.”

Kowalczyk agreed. “I think the study will give us a whole new perspective. The majority of our research today is conducted by North Americans, and this global research team is giving us a new twist. Their methodologies are different and they rely on inference more than on pure statistics. As a result, they are breaking the mold of the research internal auditing professionals typically read.”

The CFIA study is scheduled for a “grand unveiling” at The IIA’s International Conference, to be held in Dallas, Texas, in June. Internal auditors from around the world will have a chance then to preview the document that reviewers are calling “THE reference document for the internal auditing profession.

Home | Bio | Internal Auditing | Fraud Investigation | Request to Reprint

Internal Auditing and Fraud Investigation

Mark R. Simmons, CIA, CFE

Articles on Internal Auditing