Heads of Internal Audit Service Benchmarking Report Internal Audit Resources Introduction This report contains an analysis of results for the survey entitled Internal Audit Resources. The survey looks at the way Heads of Internal Audit resource their departments to provide benchmark information for managers reviewing the size of an internal audit team, the mix of qualifications and experience, and the extent to which additional resources might be brought into the team. The results include answers from 85 respondents who took the survey between Friday, July 18, 2008 and Friday, July 25, 2008. So far this is the highest number of replies for a survey issued during 2008. Responses have come from a broad cross section of private and public sector organisations with total staff numbers ranging from 200 to 50,000. The largest group is organisations with 5,000 to 10,000 staff, which represented 20% of respondents. The diversity of participating organisations is also reflected in annual turnover with over 70% having in excess of 500m. The number and scope of participating organisations therefore provide valuable comparisons. Size of Internal Audit Departments 74% of all Internal Audit Departments participating in the survey have between 0 and 10 full time equivalent staff (FTEs). A further 18% have between 11 and 25 FTEs. Only 7 respondents from the 85 that took part in the survey have more than 25 FTEs, two of whom have in excess of 100. The majority of Heads of Internal Audit believe that the size of their Internal Audit Department is likely to remain unchanged in the near future. While one third indicated that an increase may occur. The reason for this increase is mainly due to an increase in the size and turnover of the organisation, although the development of risk management and the need for specialist assurance providers were additional contributory factors. These results provide some indication that organisations continue to develop given the challenging economic situation and that there is corresponding stability and in some case increased demand for internal audit. Only 4 of the 85 respondents suggested that a reduction in organisational turnover and size would lead to reductions in the Internal Audit Department. Resourcing Internal Audit Plans The table below shows there is a wide range in the number of internal audit days that departments include in their audit plans: Internal Audit Plan Days # of Internal Audit Depts. Internal Audit Plan Days # of Internal Audit Depts. 100 200 days 4 1200 1300 days 4 200 280 days 4 1400 1500 days 5 300 days 3 1600 days 2 330 days 3 1800 days 2 350 days 3 2000 days 3 400 days 5 2750 3000 days 3 500 days 6 3500 4500 days 3 600 670 days 5 5500 6000 days 3 750 800 days 5 Above 8000 days 4 850 900 days 4 Not specified 4 1000 1100 days 9
However, there does not appear to be a discernable relationship between the number of internal audit annual plan days and the turnover of the organisation, as indicated in the table below. Annual Turnover of Organisations. Internal Audit Plan Annual Days - average Internal Audit Plan Annual Days - median 51m to 100m 575 497 101m to 200m 550 1000 201m to 350m 936 980 351m to 500m 575 608 501m to 1bn 965 850 1bn to 5bn 1700 1200 5bn to 10bn 2475 2750 Over 10bn 9725 8000 For example, the 201m to 350m band includes annual internal audit plans that range from 330 days to 1500 days. Similar variations exist in each of the bands. While the table gives an indication that the number of audit days generally increase with turnover, it would be misleading to assume that there is an established pattern that could be used for resource decisions. It would appear that internal audit planning and the resources required to complete plans is based upon organisational circumstances and an assessment of assurance needs as opposed to a resource formula. The situation is similar for internal audit departments with 11 25 FTEs, which span all of the annual turnover bands from 201m upwards. To add further factors into the planning and resource equation the survey also shows that Internal Audit Departments set aside varying levels of time to focus on the organisation s key risks and to allow for unforeseen contingencies. Risk based internal auditing is a high priority for most Internal Audit Departments with 25% of respondents indicating that they devote more than 75% of their time to risk management and a further 38% indicating it is between 51 and 75%. The % of Internal Audit time devoted to the organisation's risks Above 75% Betw een 51 and 75% Betw een 26 and 50% Betw een 1 and 25% Don't Know 0 5 10 15 20 25 30 35 Number of Internal Audit Departments Page 2
The % of Internal Audit time allocated as a contingency allow ance Above 15% Betw een 11 and 15% Betw een 6 and 10% Betw een 1 and 5% None 0 5 10 15 20 25 30 35 Number of Internal Audit Departments Qualifications and experience For some unknown reason approximately 30-40% of respondents did not complete the qualifications part of the survey so the results must be viewed with a degree of caution. The results that are available show that Internal Audit Departments rely upon a combination of the Institutes professional qualifications and professional accountancy qualifications. Between 25 and 50% of internal audit staff hold an IIA qualification. Furthermore, the survey highlights a broad range of practical experience among internal auditors, which includes working knowledge of governance, business continuity, information security, finance, project management, fraud, taxation, construction and procurement. Despite this nearly 70% of all Internal Audit Departments bring in additional resources to complete their internal audit plans with information security standing out above any other subject area. Half of all Internal Audit Departments obtain additional resources for information security compared to 25% who acquire further Finance support and 15% who source project expertise. There was a particularly high other response to this question (18%) most of which related to the need for language skills, reflecting the widening geographical scope of internal audit activity. The chart below illustrates that a variety of sources are used to acquire these additional resources. Additional resources used by Internal Audit Departments 13% 2% 18% Purchased from specialist 28% service providers Co-sourcing w ith a third party Seconded staff from a third party Independent experts from w ithin the business Other sources 39% Page 3
Conclusions Determining the size and make up of an Internal Audit Department can be a difficult thing to do. There is a need to balance the expectations of stakeholders with the cost of acquiring the resources to meet these requirements. The survey has shown that there is no formula or clear relationship between the size and turnover of the organisation to the resources required by Internal Audit. Planning and resourcing are individual to the organisation based upon the nature of the organisation, the risk profile and assurance requirements. However, the survey has identified some characteristics that may be useful in looking at the resource requirements of an Internal Audit Department. These can be summarised as follows: 74% have between 1 and 10 full time staff 25% devote more than 75% of their time to the organisation s risks 38% allocate 50-75% of their time to the organisation s risks 38% allocate 6-10% of their time as a contingency allowance Between 25 and 50% of internal audit staff hold an IIA qualification. 70% bring in additional resources to complete their internal audit plans 50% obtain additional resources for information security 39% use co-sourcing with a third party to acquire additional resources 28% buy-in specialist services. For further information and analysis about salary and recruitment levels review the Institute s 2008 Employment Survey issued in July 2008. Page 4
Heads of Internal Audit Service Benchmarking Report Copy of survey issued to Service members Internal Audit Resources The International Standards for the Professional Practice of Internal Auditing - 2030 Resource Management state that the chief audit executive should ensure that internal audit resources are appropriate, sufficient and effectively deployed to achieve the internal audit plan. The purpose of this survey is to understand how heads of internal audit resource their departments to provide benchmark information for managers who are setting up or reviewing an internal audit team. 1) What is your industry sector (choose one from this list): Banks and building societies Insurance Other financial services Food and drink Manufacturing and engineering Media and leisure Retail Telecommunications Utilities High technology Other private sector Voluntary/charity Education Central government Local government Health Other public sector None of the above 2) What is the total number of employees in your organisation? (if your organisation is international or has multiple divisions, your answer should cover only that part of the organisation which your internal audit services cover) less than 101 101 to 200 201 to 500 501 to 1,000 1,001 to 2,500 2,501 to 5,000 5,001 to 10,000 10,001 to 25,000 25,001 to 50,000 over 50,000 3) What is the turnover or gross revenue spend of your organisation? (provide the worldwide total for multinational organisations) up to 50 million or 63.5 million 51m - 100m or 65m - 127m 101m - 200m or 128m - 254m 201m - 350m or 255m - 445m 351m - 500m or 446m - 635m 501m - 1bn or 636m - 1.27bn 1bn - 5bn or 1.27bn - 6.35bn 5bn - 10bn or 6.35bn - 12.7bn Over 10bn or 12.7bn
4) How many full time equivalent (FTE) staff do you have in the Internal Audit department? 0-10 11-25 26-50 51-100 100+ 5) Within the next year do you anticipated there will be a change to the number of full time equivalents within the internal audit department? No - resources will stay much the same Yes - there will be an increase in the number of FTEs Yes - there will be a decrease in the number of FTEs 6) Please indicate the reason(s) for the expected increase or decrease. Increase Decrease A change to the size and turnover of the organisation The development of risk management The need for specialist assurance providers 7) What percentage of the internal audit department hold the following professional qualifications? 0 1-25%26-50% 51-75%76-100%100% MIIA PIIA QiCA CIA CCAB (includes AAT) Other - (please specify in additional comments) 8) In which areas does your internal department have specialist qualifications and experience? Qualifications Experience Information security Telecommunications Business Continuity Finance Taxation Construction and procurement Governance Health, safety and environment Major projects Third party activities Other (please specify in additional comments) 9) Do you require resources in addition to staff to complete your internal audit plan? No Yes 10) What sort of resources do you use? Independent experts from within the business ( guest auditors ) Co-sourcing with a third party Secondment staff from a third party Purchased from specialist service providers From other source (please specify in additional comments field) Other (please specify) If you selected other, please specify Page 6
11) Which specialist areas do the additional resources cover? Information security Telecommunications Business continuity Finance Taxation Construction and procurement Governance Health, Safety and Environment Major projects Third party activities Other (please specify) If you selected other, please specify 12) How many man days are required to complete your annual internal audit plan? To the nearest whole number eg 500 13) How many individual audits (assurance engagements and consulting engagements) are you planning to complete within the annual internal audit plan? 14) What percentage of available internal audit time is unallocated to provide a contingency? Don't Know None Between 1 and 5% Between 6 and 10% Between 11 and 15% Above 15% 15) What percentage of available internal audit time is allocated to the organisation's key risks? Don't Know None Between 1-25% Between 26-50% Between 51-75% Above 75% 16) How would you describe your organisation's risk maturity? Risk naive Risk aware Risk defined Risk managed Risk enabled Don't Know Data Protection Notice Thank you for completing the survey, your views and opinions are very important. Your response will be treated in total confidence. Completed questionnaires will be processed only by the Institute of Internal Auditors - UK and Ireland (IIA) using Vovici EFM Continuum software and will not be disclosed to any other third parties. By submitting this questionnaire you consent to our processing of your sensitive personal data for these purposes. Page 7
The Institute of Internal Auditors UK and Ireland (IIA) The IIA has been leading the profession of internal auditing for over 60 years. We are the only body focussed exclusively on internal auditing and we are passionate about supporting, promoting and training the professionals who work in it. Every year we help thousands of internal auditors at every stage of their career with training, qualifications and technical resources enabling them to deliver exceptional results for their organisations. Our International Standards and Code of Ethics unite a global community of over 130,000 IIA internal auditors. These Standards mean that employers can be sure that IIA members across the world operate with integrity and to the highest levels of professional competency. About Heads of Internal Audit Service benchmarking reports The IIA recognises that heads of internal audit need specialist information and support to help them respond to the demands of a competitive and increasingly regulated business climate. The Heads of Internal Audit Service is a complete and exclusive service designed specifically for the leaders of the profession to keep them up to date and to provide them with introductions to their contemporaries and opportunities to discuss successes and concerns in confidence with their peers. Other services include access to technical updates, a quarterly newsletter, a series of professional forums, and specifically commissioned research. The benchmarking reports are designed to help HIAS members make the most of the Service's networking opportunities. Service members can pose a question to other Service members to help them identify best practice on a particular issue. Service members can submit a question for consideration as an Enquiry by emailing chris.baker@iia.org.uk or technical@iia.org.uk Disclaimer This material is not intended to provide definitive answers to specific individual circumstances and as such is intended to be used only as a guide. The IIA recommends that you always seek independent expert advice relating directly to any specific situation. The IIA accepts no responsibility for anyone placing sole reliance on this guidance. www.iia.org.uk The Institute of Internal Auditors UK and Ireland Ltd 13 Abbeville Mews, 88 Clapham Park Road, London SW4 7BX Tel 020 7498 0101 Fax 020 7978 2492 Email technical@iia.org.uk Registered in England and Wales, no. 1474735 Information can be made available in other formats