How to Choose an Internal Auditor
Your management team and board of directors have decided to engage an outside internal auditor. Whatever the reasons – to build an in-house internal audit team, improve internal controls, or address legal concerns – a systematic selection process can assure a successful outcome.
What is a successful outcome? The chosen firm must have the professional capacity to meet your internal audit requirements and the skills to effectively engage with your employees, management and board. Moreover, the ideal firm should possess the experience and business insight to make sound suggestions to improve operations and profitability.
Establish the Selection Team and Decision Making Group
Begin the selection process by identifying the Selection Team and Decision Making Group. Given the independence and board-level accountability of internal audit activities, staff the Selection Team with at least one audit committee member as well as the CFO and necessary support staff.
The separate Decision Making Group approves or rejects the Selection Team’s recommendation. Whether the Decision Making Group is the audit committee or the entire board, formalize this in advance so that these critical stakeholders have no ambiguity about their roles.
Prepare a Preliminary Scope of Work
The Selection Team’s first task is to prepare a Preliminary Scope of Work. It should include: a business overview with sales history; work locations; employee headcount; the internal audit task list (e.g. Sarbanes-Oxley compliance, risk management review, etc.); and the engagement’s expected duration. Also note “special concerns”, such as corporate fraud. If the document contains sensitive information, classify it company confidential.
Prepare a Checklist for Internal Audit Firm Candidates
Use the Preliminary Scope of Work to draft a comprehensive Checklist for candidate firms. The checklist should identify staff requirements (e.g., who on the firm’s staff must be a Certified Internal Auditor) and specific needs such as start date, industry experience and past relevant engagements. Require the candidate to be affiliated with leading organizations such as AICPA and the Institute of Internal Auditors. Another indicator of high standards: registration with the Public Company Accounting Oversight Board.
Add checklist items to ascertain if candidates have the culture and people to effectively work with your board, management and employees. In addition, the candidates’ other services offerings and affiliations (such as ISACA) should be assessed. Even if outside of the scope of work, subject matter expertise in other fields (e.g., database security), strengthens the candidate’s qualifications.
Validate the Preliminary Scope of Work and Checklist
Circulate the Preliminary Scope of Work and Checklist to the Selection Team and Decision Making Group. Review the documents in an all-hands conference call or meeting, discuss how parts of the checklist will be weighted, and solicit formal approval. This process builds consensus, avoids last minute misunderstandings and assures that the final recommendations will be based common goals and criteria.
Select Candidate Firms
Selection Team staff should begin by drawing up a list of candidate firms. Sources should include web search and referrals from board members and trusted partners. Local chapters of the Institute of Internal Auditors may have suggestions. Public sources should be used to vet each candidate against the Checklist. Cut the list to the best six to eight potential candidates.
Initial screening calls with the candidates should be made by the CFO or audit committee member. (This usually assures quick access to the firm’s senior partner or practice leader.) If warranted, a summary of the Preliminary Scope of Work should be shared and follow-up calls made to determine if the candidate meets the general Checklist criteria and has the resources to undertake the engagement.
After evaluation of the screening calls, invite two to four firms to make a formal presentation and preliminary proposal. Provide the candidate firms with the complete Preliminary Scope of Work and execute non-disclosure agreements as needed. (Note: This informs candidates of “special concerns”, as mentioned above, and makes certain they will be addressed in the presentations.)
Advise the candidates in advance about your expectations. While supervisory partners should be present, the individual slated to lead the engagement should conduct the presentation. The firm should present its approach to the engagement and the industry standards applied to its work processes. Resumes of those to be assigned to the program must be presented.
During presentations the Selection Team should probe the candidates: How will the firm’s engagement strategy and staff qualifications produce superior results compared to other firms? How will the candidate’s industry experience be leveraged? Can the Preliminary Scope of Work be revised to more cost effectively achieve the organization’s goals?
The Selection Team should also judge the candidates’ fact-finding approach. Are their questionsdirect? Do they display an expert knowledge of the industry and relevant internal audit processes?
After evaluating the presentations, cut the final list of candidates to two or more firms. Provide the finalists with any revisions to the Scope of Work and task them to provide a written proposal with a detailed plan, schedules, fees, time lines, and staffing. Be available to answer detailed questions about the Scope so that the finalists can develop competitive quotations.
While price is important, greater weight should be placed on the candidate firm’s qualifications. If the low-bidder is rated as marginally qualified to execute the scope of work, it’s likely their results will be equally marginal. Choose the firm that’s got the strongest leadership, the deepest relevant experience, and a detailed, practical execution plan. Finalize the selection by undertaking in-depth reference checks with previous clients.
Once the Selection Team makes its recommendation, schedule the chosen firm for a final presentation to the Decision Making Group. A successful presentation proves the finalist can clearly and effectively communicate with its client. In turn, that confirms the Selection Team’s choice and starts the relationship with the new internal audit firm on a high note.
I.S. Partners, LLC has built its internal audit practice on business insight, experience, and trust. Ask us how we can strengthen your organization. For more information, call 215-675-1400 or email us at [email protected]