Neither literature nor the IIA’s IPPF provide a clear definition of the concept of non-auditors. Therefore, we developed definitions to be used in this research based on the project groups’ experience in the internal audit field and validated these with part of IIA Netherlands’ network of internal auditors responsible for professional practices (during a IIA Netherlands’ CPP event held on the 8^th of November 2018).

Prior to defining a non-auditor it is considered what defines an auditor in the context of this research:

An auditor is a person working for an internal audit department with an educational background in auditing.

In The Netherlands an educational background in auditing often entails a RA (Registered Accountant), RO (Registered Operational auditor), RE (Registered EDP auditor) or CIA certification. There is also a variety of post-HBO studies as well as internal audit education provided by commercial organizations. This leads to the definition of a non-auditor:

Non-auditors are all persons that do not have an educational background in auditing yet work for an internal audit department.

Throughout the academic literature and IIA’s IPPF¹ different types of non-auditors are mentioned. Three different types of non-auditors derived are:

• guest auditors;
• rotational auditors;
• subject matter experts.

Clear and coherent definitions for the different types of non-auditors are not always provided within literature. In line with Christ et al. (2015) this research will use the following types of non-auditors:

• Guest auditor: a person with a career outside of the internal audit profession, temporarily joining an IAF in one or more audits, for a specific period of time. Two subtypes are considered: an internal guest auditor from within the organization and a hired guest auditor from outside the organization.
• Rotational auditor: a person with a previous career outside of the internal audit profession, joining an IAF for 1 – 5 years, with the intention to rotate back to a different role outside of the IAF. Two subtypes are considered: an internal rotational auditor from within the organization and a hired rotational auditor from outside the organization. The hired rotational auditor is also called an exchange auditor.
• Subject matter expert (SME): a person from another function or organization, who is participating in (part of) one or more audits mainly for his/her knowledge of the subject of the audit. In comparison with the guest and rotational auditor the subject matter expert often does not engage throughout the entire internal audit process. Two subtypes are considered: an internal subject matter expert from within the organization and a hired subject matter expert from outside the organization.

Based on literature and the authors’ own experience an additional dimension is added to the different types of non-auditors: internal versus external. Academic research shows that (part of) Internal Audit services are increasingly sourced through third parties (Mubako 2019), including both auditors and non-auditors (for example by hiring subject matter experts). Other research indicates (Christ et al. 2015) a positive link between outsourcing (part of) the internal audit function and the use or rotational auditors, although a conclusive explanation for this is not provided.

Within this study only externals that qualify as non-auditors are considered. Trained auditors from an external organization joining an IAF do not qualify as non-auditors according to the definition above, even though different IAFs consider these auditors to be a ‘guest’ to the IAF.

Table 1 summarizes the types of non-auditors and their expected contribution.

Table 1.Download as CSV 

Types of non-auditors.

Types of non-auditors		Expected contribution
		Audit execution support		Subject matter expertise
Source	Internal	Internal guest auditor	Internal rotational auditor	Guest SME
	External	Hired guest auditor	Hired rotational auditor	Hired SME

Literature indicates that the use of non-auditors has the potential to impair independence of the IAF and impair objectivity of the (non-) internal auditor (Christ, et al. 2015). The concepts of independence and objectivity are central in the IIA’s IPPF and at the core of the internal audit profession. These concepts are defined as follows:

“ Independence is the freedom from conditions that threaten the ability of the internal audit activity to carry out internal audit responsibilities in an unbiased manner.”

“ Objectivity is an unbiased mental attitude that allows internal auditors to perform engagements in such a manner that they believe in their work product and that no quality compromises are made. Objectivity requires that internal auditors do not subordinate their judgment on audit matters to others.”²

The concept of independence is tied to the IAF whereas the concept of objectivity is tied to the Internal Auditor.

Non-auditors (specifically rotational auditors) work in the IAF for a specific period with the goal of moving on in a different (possible managerial) position in the organization. As part of their internal audit assignment they might have to audit the managers that are considering them for a future role. It can open the non-auditor to social pressures and economic interest threatening objectivity. Prior research using experiments has demonstrated this for rotational auditors (Christ et al. 2015).

Regarding external non-auditors different dynamics are in play (Mukabo 2019). As they are not employees of the organization, they do not face the same social pressure and economic interest, thereby being more independent than in-house internal auditors (Bartlett et al. 2017, Loh et al. 2019). Research shows that outsourced internal auditors are less compromised in their objectivity (Loh et al. 2019). On the other hand, outsourcing (part of) the IAF opens up the possibility of other independence concerns especially when the party to whom the IA services are outsourced is also providing other services to the organization, or intents to perform other services in the future.

Other research demonstrates independence impairments of internal auditors’ risk assessments. IAFs without rotational auditors perform risk assessments that do not significantly differ when sending reports to senior management versus sending reports to the audit committee. A difference does occur when the IAF contains rotational auditors: internal auditors’ risk assessments contain significantly lower risks when the IAF reports to senior management than when the IAF reports to the audit committee. Additionally, when the IAF does contain rotational auditors, the internal auditor provides judgments more aligned with management’s preferences than when no rotational auditors are present (Hoos et al. 2014).

A third topic briefly coming forward in both literature and IIA’s IPPF and IIA NL’s CPP event is the selection and reward of non-auditors. Prior research has been conducted around the factors influencing the recruitment of business professionals into internal audit (Bartlett et al. 2017). It shows that high-performers are more interested in internal audit work if the work would be ‘less boring / tedious’ whereas low performers are motivated by financial aspects.

The literature review reveals that supervision, including quality review, training, as well as training and mentoring on job all contribute to improved audit competency and quality of audit outputs by non-auditors. These factors were confirmed by our interviews as well. Key elements of IA supervision mentioned during the interviews include the following tips:

• Provide on-site supervision during audit execution to non-auditors. Ensure they have an audit team leader or supervisor to whom questions and concerns can be addressed. This may include accompaniment during interviews and other key interactions with audit stakeholders such as audit close-out meetings.
• Provide coaching to accelerate learning, and quickly reduce the top competency and quality related issues facing non-auditors.
• Allocate a quality reviewer for all deliverables prepared by the non-auditors prior to a final review taking place.
• In case of larger IAFs, allocate a dedicated Professional Practice Quality leader who reviews all audit deliverables and the Internal Audit methodology to ensure the Internal Audit function is operating in line with recognized quality standards at all times.

To reduce the risk of compromises to audit quality some IAFs allocate non-auditors specifically to specific audit activities such as audit execution (fieldwork). Other audit activities were taken on by core internal auditors. Such activities include: final say on audit scoping, communications with higher profile stakeholders, report editing and drafting, and remediation monitoring. Some interviewees stated that guest auditors best be allocated to tasks and responsibilities in line with their strengths which may include key language skills, business knowledge and subject matter expertise rather than the full spectrum of audit activities. Typically these strengths are more used in direct interactions with auditees, for example in interviews and closing/report meetings rather than in ‘behind-the-scenes’ work such as internal audit file work or testing of documentation.

The most commonly cited means to improve non-auditor audit competency and thereby mitigate quality risks is to deploy on-boarding training for non-auditors. Interviews cited the following topics to typically be covered in on-boarding classroom trainings:

• IA Methodology: including topics such as the internal audit execution approach; key action check lists; audit scheduling approach; and timing and key activities.
• Audit techniques: including interview techniques, critical thinking, sampling, risk assessment, control testing, and report writing techniques.
• Internal Audit basics: process basics, risk basics, control basics; issue identification; root causes analysis.

Such on-boardings are designed to provide a crash course to non-auditors and ensure that the most critical elements of audit techniques are covered prior to handing over responsibilities to the non-auditors. The length of on-boarding training differs between IAFs from (part of) a day up until a week.

The amount of formalization differs per IAF, with larger IAFs having a more structural training developed and held on fixed periods in time, while smaller IAFs use less formalized methods.

Similar to the on-boarding packs, interviewees also shared examples of ongoing training, particularly for rotational auditors and guest auditors that are engaged for longer periods of time (longer than 1 year). Examples of such trainings include summer training programs, annual team learning events, and IIA hosted events. Here again the primary aim of these training courses for non-auditors is to bring them up to speed on the latest and most critical Internal Audit techniques required for the non-auditors to deliver quality audit outputs. The length of the training course again differs per IAFs ranging from (part of) a day up until a week.

Interviewees also cited the use of SharePoint and other knowledge sharing portals specifically established for non-auditors to share knowledge, tips and tricks with each other. Such portals aim to provide non-auditors with a forum to collaborate and share better practices. Non-auditors are often well placed to provide training to each other given the similarity of their circumstances, and may, in some cases, be the ideal candidates to know what information is most helpful to another non-auditor at a given stage in their IA development.

Several interviewees indicated the importance of continuous and open discussions to be held to ensure adequate mindset regarding objectivity and independence. They require audit team members to challenge each other on an independent and objective mindset and behavior during all phases of the audit. It needs to be clear to all team members that no close relations or career perspectives may be at play to adequately ensure independence and objectivity.

In another IAF open and regular communication about the (non)auditor’s next envisioned career steps outside of the IAF is used to prevent impairment of independence and objectivity. Such measure may be less effective in case of external guest auditors and/or SMEs.

One IAF representative stressed that an independent and objective mindset is not only an individual responsibility; ensuring independence and objectivity ultimately is leadership’s responsibility. Therefore staff should be encouraged to approach leadership in case they encounter potential independence issues. It takes a joined effort from the CAE and each (non)auditor to adequately manage objectivity/independence issues.

Literature as well as our interviews revealed that possible impairment to objectivity may be prevented by having the lead auditor, who is part of the IAFs core team respectively a permanent IAF staff member, reviewing the work performed by the non-auditor. Keeping the overall responsibility for the audit not with the (temporary) non-auditor may be a good measure to mitigate possible independence/objectivity impairments.

Some interviewees indicated that they prevent limitations to independence/objectivity by requiring non-auditors to explicitly confirm that they will adopt the IIA Code of Ethics.

The following better practices have been identified specifically with respect to rotational auditors.

Literature as well as interviews indicate that independence/objectivity may be ensured by requesting rotational auditors to sign an independence declaration when starting within the IAF as well as asking for a periodic (for example annual) reconfirmation and/or an ad hoc reconfirmation in case of any changes. By these declarations rotational auditors explicitly confirm that their objectivity and independence is not at stake due to prior work and/or close relationships.

Strict application of a general rule prohibiting rotational auditors to audit the area where they have been working previously for a certain period of time (for example 1 year) may ensure independence/objectivity according to literature, the IPPF (1 year) and information provided during our interviews.

A better practice was identified with respect to open communication on the fact that rotational auditors that critically challenged the status quo during their audits respectively performed audits with great impact more likely than not were able to obtain desirable management positions after rotating back into the business. This better practice may mitigate the risk that rotational auditors may be tempted to be less objective during their audits in order to not endanger future career opportunities.

One IAF prevents impairment of independence/objectivity by conducting feedback sessions after every audit. In these sessions rotational auditors are challenged on their decisions by their peers.

We noted that often the same better practices applied with respect to guest auditors and SMEs, probably as both types of non-auditors are working within the IAF for only a short period of time.

Several interviewees stated that guest auditors and SMEs are requested to sign a letter declaring that no conflict of interest applies with respect to the audit they will be involved in, for example no prior work history and/or personal relationships etc. in order to safeguard independence/objectivity.

Strict application of a general rule prohibiting guest auditors and/or SMEs to participate in audits of the department or processes they work for may ensure independence/objectivity was mentioned by several IAF representatives.

IAF representatives of smaller organizations indicated that internal staffing with guest auditors or SMEs often cannot be arranged for due to independence and objectivity limitations. Their solution to this problem was hiring external resources (external guest auditors and/or external SMEs). A fresh pair of eyes from an outsider, not involved in the processes or departments to be audited can operate more independent and objective.

During our interviews we noted a limited number of IAFs that applied rotational auditors as a general way of working (100% rotational internal auditors). The majority of IAFs interviewed engaged rotational auditors more on an occasional basis driven by career paths of individuals. Some IAF representatives indicated that a more structural application of a rotation model could be beneficial, even if this would mean ‘accepting’ a higher turnover rate. To make the rotational model work one should consider the ‘inflow’ as well as the ‘outflow’.

To select and recruit capable non-auditor to join the IAF, several interviewees indicated that keeping close relationships within the organization is a key factor for success. Future guest auditors, SMEs or rotational auditors can come from these audited departments. A better practice identified is the sharing of IAF vacancies with these departments.

Interviews revealed that commitment from senior leadership is important to the successful implementation of a rotational auditor program.

Other IAF representatives indicated that it is important to adequately manage the outflow from IAF after the rotational period, in order to attract good candidates. Maintaining good relationships with HR and the business ensures that rotational auditors leave the IAF into roles in line with their career path.

Another better practice identified relates to the establishment of a knowledge-expertise matrix. By this the IAF can clearly communicate what kind of SME areas are required. This instrument is considered very helpful for recruitment and back-up purposes.

IAF representatives indicated that it is considered important to have a formalized process in place with the involvement of HR when engaging non-auditors.

Some IAFs we have interviewed had internalized SMEs permanently into the IAF. This better practice might be feasible for larger IAFs only. This holds for both expert knowledge (for example about the applicable regulations) and business knowledge (for example about the applicable markets for the organization).

Most interviewees stated that they evaluate rotational auditors in the same way as auditors by using common evaluation processes and KPI’s. Some IAFs vary based on the role of the non-auditor during the audit, for example if non-auditors are not involved throughout the entire audit.

IAF representatives indicated that transparency about what contribution is expected of the non-auditor should be clarified before the start of the audit. The related evaluation criterion should be defined on a case-by-case basis and evaluated at the end of the audit.

The research is partly based on interviews with representatives of IAFs. The information provided in these interviews was not validated by studying additional documentation such as Internal Audit Charters or Internal Audit Manuals. Further research could add this to validate and enrich the measures included in this article.

While the project team has attempted to ensure a broad applicability of results by selecting a diverse range of IAFs, time and resources constraints limited the team to 17 organizations. A larger sample of organizations could further validate and extend the results.

The IAFs interviewed were all (partially) based within The Netherlands, though multiple of the selected organizations also operate abroad. Selecting a different geography might impact results.

The goal of the research was to provide better practices regarding the use of non-auditors and did not intent to extensively research when and why non-auditors are used. This too could be an interesting area for further research.

The definition of non-auditors used in this study led to discussions with several interviewees and revealed there is no clear consensus between IAFs on how to define non-auditors. The topics of rotational, guest and SME auditors are widely known and in use by internal audit functions, yet often mean different things. While the definitions used in this research attempt to be exhaustive and complete, we noted several examples of non-auditors used during the interviews that challenge the definitions used in here. Further work could be done to detail/finetune the definitions.