Corresponding author: Gijs Hendrix (
Academic editor: Peter Hartog
To bring a high level of expertise on-board Internal Audit Functions (
This article shares better practices regarding the use of non-auditors in the
The purpose of this article is to share better practices as described in literature and actually experienced regarding the use of non-auditors in the
First definitions are provided of (the different types of) non-auditors. Afterwards we present advantages of the use of non-auditors and identify three main topics of interest in the use of non-auditors in the
Neither literature nor the
Prior to defining a
In The Netherlands an educational background in auditing often entails a RA (Registered Accountant), RO (Registered Operational auditor), RE (Registered EDP auditor) or CIA certification. There is also a variety of post-HBO studies as well as internal audit education provided by commercial organizations. This leads to the definition of a non-auditor:
Throughout the academic literature and
guest auditors;
rotational auditors;
subject matter experts.
Clear and coherent definitions for the different types of non-auditors are not always provided within literature. In line with
Guest auditor: a person with a career outside of the internal audit profession, temporarily joining an IAF in one or more audits, for a specific period of time. Two subtypes are considered: an internal guest auditor from within the organization and a hired guest auditor from outside the organization.
Rotational auditor: a person with a previous career outside of the internal audit profession, joining an IAF for 1 – 5 years, with the intention to rotate back to a different role outside of the IAF. Two subtypes are considered: an internal rotational auditor from within the organization and a hired rotational auditor from outside the organization. The hired rotational auditor is also called an exchange auditor.
Subject matter expert (SME): a person from another function or organization, who is participating in (part of) one or more audits mainly for his/her knowledge of the subject of the audit. In comparison with the guest and rotational auditor the subject matter expert often does not engage throughout the entire internal audit process. Two subtypes are considered: an internal subject matter expert from within the organization and a hired subject matter expert from outside the organization.
Based on literature and the authors’ own experience an additional dimension is added to the different types of non-auditors: internal versus external. Academic research shows that (part of) Internal Audit services are increasingly sourced through third parties (
Within this study only externals that qualify as non-auditors are considered. Trained auditors from an external organization joining an
Table
Types of non-auditors.
Types of non-auditors | Expected contribution | |||
---|---|---|---|---|
Audit execution support | Subject matter expertise | |||
Source | Internal | Internal guest auditor | Internal rotational auditor | Guest |
External | Hired guest auditor | Hired rotational auditor | Hired |
The use of non-auditors within the
Advantages of using non-auditors.
Advantages of using non-auditors | For the non-auditor | For the |
For the organization |
---|---|---|---|
Exports an appreciation of governance, risks, and controls throughout the organization. | X | X | |
Acquisition of more in-depth knowledge of the respective business area | X | ||
Cultivation of better customer relations | X | X | |
Heightened awareness of organizational sensitivity and business acumen | X | ||
Improvement of personal and career development | X | X | |
Infusion of fresh ideas and perspectives, motivation to current internal auditors | X | X | |
Creates an appreciation of the role of the internal audit function | X | X | |
Enhancement of specific internal audit skills and competencies | X | X | |
Evolving view of internal audit as a potential source of talent for the enterprise | X | X |
Source:
Throughout academic literature, the
Competence and quality;
Independence and objectivity;
Selection and reward.
These topics are explained in detail below.
The
Literature mentions quality compromises in relation to rotational auditors (
Most of the literature focuses on internal audit work related to financial reporting and does not specify the effect on internal audit quality of internal audit work not related to financial reporting.
For guest auditors and SMEs we assume similar risks as these non-auditors similarly have limited internal audit experience, certifications and training. Research is not conclusive on the effects on quality when comparing in-house internal audit departments versus outsourced internal audit departments (
Interviewees stated that when (internal/external) non-auditors with different backgrounds and/or specific knowledge are combined with auditors within the
Literature indicates that the use of non-auditors has the potential to impair independence of the
“
“
The concept of independence is tied to the
Non-auditors (specifically rotational auditors) work in the
Regarding external non-auditors different dynamics are in play (Mukabo 2019). As they are not employees of the organization, they do not face the same social pressure and economic interest, thereby being more independent than in-house internal auditors (
Other research demonstrates independence impairments of internal auditors’ risk assessments.
A third topic briefly coming forward in both literature and
The central question answered in this research is
“
Based on the three topics identified above three sub-questions are formulated:
What are better practice controls to optimize competence and quality of non-auditors in the internal audit?
What are better practice controls to optimize independence/objectivity of the IAF and non-auditors?
What are better practices around the selection and reward of non-auditors in the IAF?
This study is an explorative one, it aims to explore the Internal Audit field and present better practices around using non-auditors in the
study of academic research about non-auditors;
interviews with representatives of IAFs.
The results of the study of academic research were combined to develop the literature analysis presented in section 2 and to develop an interview guide to structure the interviews. Both the academic research as well as the interviews brought forward better practices in working with non-auditors.
We searched SSRN and Google Scholar databases with a wide range of search terms around internal auditing and the different kinds of auditors. The search resulted in a series of articles found in different publications related to business, organizations and (management) accounting. We have carefully studied the articles and used relevant elements in both section 2 and section 4.
The goal of the interviews was to provide real-life examples when engaging non-auditors. Qualitative data was collected using a semi-structured interview approach with an interview guide prepared to provide focus during the interviews. This approach allowed for rich data to be collected. The interviews have been transcribed in a summarized form and validated with the interviewees to ensure correctness. The interviews have thereafter been coded and analyzed. The results of the interviews and analysis are presented in anonymous form on request of (several of) the interviewees.
We have approached
Interviewees all worked as internal auditors within
A total of 19 interviews were conducted within 17 different organizations. We deliberately targeted organizations in a diverse range of sectors (including but not limited to financial services, manufacturing, professional services, fast-moving consumer goods, semi-governmental, construction and natural resources). The size of the
Interviews offered insight into the practices
Literature studied showed a negative link between the use of non-auditors (rotational auditors) and the effectiveness and quality of the internal audits performed. Interviewees consistently had an opposite perception of this link, they indicated the use of non-auditors increases the quality and effectiveness of the
The literature review revealed the following measures used to mitigate competency and quality related risks:
consistency and continuity of IA supervision;
limiting the use of non-auditors to specific phases of the audit.
During the interviews respondents shared the practices and controls they put in place when engaging non-auditors to mitigate these risks and overcome the associated challenges. The five measures identified are shown in Table
Better Practices around competence and quality of non-auditors.
Better practice | Rotational auditor | Guest auditor |
|
---|---|---|---|
Consistency and continuity of IA supervision* | X | X | X |
Limiting the use of non-auditors to specific phases of the audit* | X | X | X |
On-boarding training and welcome packs | X | X | X |
Training courses (ongoing) | X | X | |
Knowledge sharing and on-the-job learning | X | X | X |
*) Items flagged with an asterisk were identified in the interviews as well as the literature review.
Each of these five measures is equally applicable for rotational, guest, and
The literature review reveals that supervision, including quality review, training, as well as training and mentoring on job all contribute to improved audit competency and quality of audit outputs by non-auditors. These factors were confirmed by our interviews as well. Key elements of IA supervision mentioned during the interviews include the following tips:
Provide on-site supervision during audit execution to non-auditors. Ensure they have an audit team leader or supervisor to whom questions and concerns can be addressed. This may include accompaniment during interviews and other key interactions with audit stakeholders such as audit close-out meetings.
Provide coaching to accelerate learning, and quickly reduce the top competency and quality related issues facing non-auditors.
Allocate a quality reviewer for all deliverables prepared by the non-auditors prior to a final review taking place.
In case of larger IAFs, allocate a dedicated Professional Practice Quality leader who reviews all audit deliverables and the Internal Audit methodology to ensure the Internal Audit function is operating in line with recognized quality standards at all times.
To reduce the risk of compromises to audit quality some
The most commonly cited means to improve non-auditor audit competency and thereby mitigate quality risks is to deploy on-boarding training for non-auditors. Interviews cited the following topics to typically be covered in on-boarding classroom trainings:
IA Methodology: including topics such as the internal audit execution approach; key action check lists; audit scheduling approach; and timing and key activities.
Audit techniques: including interview techniques, critical thinking, sampling, risk assessment, control testing, and report writing techniques.
Internal Audit basics: process basics, risk basics, control basics; issue identification; root causes analysis.
Such on-boardings are designed to provide a crash course to non-auditors and ensure that the most critical elements of audit techniques are covered prior to handing over responsibilities to the non-auditors. The length of on-boarding training differs between
The amount of formalization differs per
Similar to the on-boarding packs, interviewees also shared examples of ongoing training, particularly for rotational auditors and guest auditors that are engaged for longer periods of time (longer than 1 year). Examples of such trainings include summer training programs, annual team learning events, and
Interviewees also cited the use of SharePoint and other knowledge sharing portals specifically established for non-auditors to share knowledge, tips and tricks with each other. Such portals aim to provide non-auditors with a forum to collaborate and share better practices. Non-auditors are often well placed to provide training to each other given the similarity of their circumstances, and may, in some cases, be the ideal candidates to know what information is most helpful to another non-auditor at a given stage in their IA development.
This section provides the answer to the second research question:
Based on our literature review we identified the following mitigating measures:
consistency and continuity of IA supervision;
Audit Committee oversight;
separation of internal audit staff and staff used for non-audit services;
limiting the use of non-auditors to specific phases of the audit;
prohibition to audit the department for which they have worked before;
conflict of interest statement.
During our interviews we identified the measures included in Table
Better Practices around independence and objectivity of non-auditors.
Better practice | Rotational auditor | Guest auditor |
|
---|---|---|---|
Creation of awareness | X | X | X |
Openness about career developments | X | X | X (internal) |
X | X | X | |
Supervision / review by lead auditor* | X | X | X |
Explicit adaption of |
X | X | X |
(Annual) Independence declarations* | X | ||
Independence confirmation letter per audit* | X | X | |
Application of cooling-off period* | X | ||
Limitation of audit areas/locations* | X | X | |
Clear communication on role models | X | ||
Audit evaluations | X | ||
External sourcing * | X | X |
*) Items flagged with an asterisk were identified in the interviews as well as the literature review.
Audit Committee oversight and limiting the use of non-auditors to specific phases of the audit were not mentioned during our interviews, probably as
During our interviews we identified mitigating measures applying to all types of non-auditors, as well as measures specifically applying to rotational auditors on the one hand or guest auditors and SMEs on the other hand.
We identified several better practices that can be used to prevent the impairment of independence or objectivity of non-auditors independent of the type of non-auditor (see Table
Several interviewees indicated the importance of continuous and open discussions to be held to ensure adequate mindset regarding objectivity and independence. They require audit team members to challenge each other on an independent and objective mindset and behavior during all phases of the audit. It needs to be clear to all team members that no close relations or career perspectives may be at play to adequately ensure independence and objectivity.
In another
One
Literature as well as our interviews revealed that possible impairment to objectivity may be prevented by having the lead auditor, who is part of the
Some interviewees indicated that they prevent limitations to independence/objectivity by requiring non-auditors to explicitly confirm that they will adopt the
The following better practices have been identified specifically with respect to rotational auditors.
Literature as well as interviews indicate that independence/objectivity may be ensured by requesting rotational auditors to sign an independence declaration when starting within the
Strict application of a general rule prohibiting rotational auditors to audit the area where they have been working previously for a certain period of time (for example 1 year) may ensure independence/objectivity according to literature, the
A better practice was identified with respect to open communication on the fact that rotational auditors that critically challenged the status quo during their audits respectively performed audits with great impact more likely than not were able to obtain desirable management positions after rotating back into the business. This better practice may mitigate the risk that rotational auditors may be tempted to be less objective during their audits in order to not endanger future career opportunities.
One
We noted that often the same better practices applied with respect to guest auditors and SMEs, probably as both types of non-auditors are working within the
Several interviewees stated that guest auditors and SMEs are requested to sign a letter declaring that no conflict of interest applies with respect to the audit they will be involved in, for example no prior work history and/or personal relationships etc. in order to safeguard independence/objectivity.
Strict application of a general rule prohibiting guest auditors and/or SMEs to participate in audits of the department or processes they work for may ensure independence/objectivity was mentioned by several
In this section we will answer the third research question:
For many
Better Practices around selection and reward of non-auditors.
Better practice | Rotational auditor | Guest auditor |
|
---|---|---|---|
Structural implementation of a rotational audit model | x | ||
Close relationships throughout the organization | x | x | x |
Leadership commitment | x | ||
Offer good roles in the business | x | ||
Maintain an actual knowledge-expertise matrix | x | x | x |
Align recruitment of non-auditors with organizations’ practices | x | x | x |
Internalize subject matter expertise in the |
x | ||
Evaluate rotational auditors in the same way as auditors | x | ||
Define criteria to evaluate guest auditors and SMEs on a case-by-case basis | x | x |
During our interviews we noted a limited number of
To select and recruit capable non-auditor to join the
Interviews revealed that commitment from senior leadership is important to the successful implementation of a rotational auditor program.
Other
Another better practice identified relates to the establishment of a knowledge-expertise matrix. By this the
Some
Most interviewees stated that they evaluate rotational auditors in the same way as auditors by using common evaluation processes and KPI’s. Some
Internal audit functions globally increasingly include non-auditors in audit teams to increase quality and to be able to quickly adapt to organizational developments. This brings several advantages to the
This research providers better practices around the use of non-auditors in internal audits, measures that can support
The measures were presented around three topics: competence and quality, independence and objectivity and selection and reward. Supervision, specific use of non-auditors and classroom training are examples of better practices around competence and quality. To ensure independence and objectivity multiple better practices were shared, including openly addressing the topics, clear supervision by explicit adaptation of the
The research is partly based on interviews with representatives of
While the project team has attempted to ensure a broad applicability of results by selecting a diverse range of
The
The goal of the research was to provide better practices regarding the use of non-auditors and did not intent to extensively research when and why non-auditors are used. This too could be an interesting area for further research.
The definition of non-auditors used in this study led to discussions with several interviewees and revealed there is no clear consensus between
See for example the Implementation Guidance for Standard 2030 and 2230.