The IIA recommends that an assessment be made at least every five years, but most CAEs want to know how well they are doing every year.
When I became a CAE, I started by benchmarking against firms that had a great reputation, either for their business practices or internal audit departments. That is still a good idea and I recommend it. But in my case I found so many practices that disturbed me that after a couple of years I only met with CAEs whose presentations at conferences indicated they led practices I would admire. For example, one major company’s auditors spent 60% of their audit time on documentation, which is far too much, and would continue to perform audit work until their allocated time ran out even if they had completed the defined scope. Another said they had a risk-based approach; but they then said that every function and process is audited at least once every five years on a cyclical basis. That is not risk-based internal auditing.
I highly recommend attending conferences and seminars to keep up-to-date, build and maintain a network, and hear from your peers and thought-leaders. However, always listen with both an open and questioning mind. Not all so-called thought leaders should (IMHO) be considered up to world-class levels. This blog is quite active in criticizing some of the guidance…
