I have recently seen a few articles that discuss this issue, including:
X
Before diving into these pieces, I want to recommend the use of a maturity model to assess an internal audit function. While there is huge value in asking our customers to assess our value to them and their success, it is also hugely valuable to assess the structure, process, and staffing of the internal audit department – and I believe a maturity model is the best way. One can be found (mine) in Is your internal audit world-class? A maturity model for internal audit.
Also before considering these articles, I want to make another very important point:
Compliance (or conformance) with the IIA’s Standards is neither an indication nor a guarantee of quality internal audit practices and the delivery of the valuable assurance, advice, and insight our leaders need in driving the organization to success.
I am not saying that we should ignore the Standards or deliberately violate them. They are useful food for thought. I have written elsewhere about their shortcomings and will not repeat them here. (OK, I lie; they provide guidance on auditing risks to a process or auditable entity rather than risks to enterprise objectives (true risk-based auditing) and confuse an audit universe with a risk universe; they fail to talk about insight; they…
