Internal Audit Resources 2010

Heads of Internal Audit Service Benchmarking Report Internal Audit Resources 2010 Introduction This report contains an analysis of results for the Heads of Internal Audit Service survey entitled: Internal Audit Resources 2010. The survey looks at the way Heads of Internal Audit resource their departments to provide information to managers who may be reviewing the size of an internal audit team, the mix of qualification and experience and the extent to which additional resources need to be bought in. The survey partially repeats a survey carried out in 2008 and where possible we have compared results. The results include answers from 52 members of the Heads of Internal Audit Service who completed the survey in the 14 day period from Thursday, 6 May 2010 to Thursday, 20. Responses have come from a broad cross section of private and public sector organisations. The largest grouping (35% of respondents) is that of organisations with annual turnover between 501m and 1bn. Reporting lines and the size of Internal Audit Departments The survey informs us that for management and administrative purposes half of Heads of Internal Audit report to the Chief Financial Officer, while a quarter report to the Chief Executive. Other reporting lines for the remaining 25% include Company Secretary, Head of Governance and Chief Risk Officer. The results regarding the size of Internal Audit Departments have come as something of a surprise. As the chart below shows, the size of some internal audit departments has increased in the past year even though the economy is in recession. In total 10% of Internal Audit Departments have grown, with the main movement in departments of 1 to 4 full time equivalents (FTEs) increasing to 5 to 9 FTEs. Only 4% of Internal Audit Departments surveyed have experienced a decrease with the vast majority remaining the same. Internal audit full time equivalents Number of respondents 30 25 20 15 10 5 0 FTEs this time last year FTEs now 1 to 4 5 to 9 10 to 24 25 to 49 50 to 100 100 or more Department size

It would seem this growth is likely to continue as 27% of respondents also informed us they envisage an increase in the size of their department during the year ahead. Analysis shows that this will occur across all department sizes but it is interesting to note that 6 of the 14 respondents who predict an increase operate within the insurance sector. The precise reason for this is unknown but we speculate that this may be due to the impact of Solvency II as most of these respondents said that the reason for the change will be due to the development of risk management in their organisation. The majority of small Internal Audit Departments, those between 1 and 4 FTEs, rely on part time internal auditors with 19 of the 23 respondents in this grouping having a part time contingent. The only other reported use of part time staff exists in the 5 to 9 FTEs group with 3 of the 19 Internal Audit Departments having a part time staff. Resourcing Internal Audit Plans The number of days and individual audits needed to complete an Internal Audit Plan varies considerably between organisations, private and public. The table below provides an indication of the range of days and audits for each of the team size groupings. Size of internal audit department Lowest number of days allocated to the plan Highest number of days allocated to the plan Mode of days allocated to the plan 1 to 4 150 800 400 5 to 9 450 1600 1000 10 to 24 1100 2600 2000 25 to 49 3800 6800 5500 Size of internal audit department Lowest number of audits Highest number of audits Mode of number of audits 1 to 4 7 100 20 5 to 9 6 112 50 10 to 24 50 80 80 25 to 49 90 360 360 There is no clear pattern between the size of the Internal Audit Department and the number of days or audits set out in the Internal Audit Plan. Equally the size and turnover of the organisation does not seem to determine the size of the Internal Audit Department. For example within the largest turnover grouping, 501m to 1bn, the number of days allocated to the plan varies between 200 and 1600 internal audit days with a variation of audits between 14 and 110. In practice there must be a range of factors that have a bearing on the size of Internal Audit Departments. This might include the number of business units, geographical spread, risk profile, stakeholder expectations, the need for specialist audit skills and the type and nature of operations. Nevertheless, we have highlighted the days and audits that occur most often for each grouping in the mode column of the table. However, we suggest that these figures be treated with a high degree of caution and should not be regarded as benchmarks. There are also variations in the amount of time that each internal audit team devotes to the organisation s risks, as shown in the chart below. Page 2

The % of Internal Audit time devoted to the organisation's risks Above 75% Betw een 51 and 75% Betw een 26 and 50% Betw een 1 and 25% Don't Know 0 2 4 6 8 10 12 14 16 18 Number of Internal Audit Departments Qualifications and experience The results show that Internal Audit Departments rely upon a combination of the Institute s professional qualifications and professional accountancy qualifications. Between 25 and 50% of internal audit staff hold an IIA qualification. This is similar to the results from 2008. The survey also highlights a broad range of qualifications and practical experience among internal auditors, which includes working knowledge of information security, finance, governance, project management business continuity, fraud, taxation, construction and procurement. Despite this nearly 60% of all Internal Audit Departments bring in additional resources to complete their Internal Audit Plans. Overall this is 10% lower than the level recorded in the 2008 survey. We have prepared a table, below, comparing 2008 and 2010 results over the main subject areas where additional resources are required. Taxation is the only subject area higher in 2010. Additional resources acquired by internal audit departments 2008 2010 Information security 49% 36% Taxation 13% 19% Finance 20% 15% Health, safety and environment 11% 11% Major projects 15% 9% Business continuity 8% 7% Telecommunications 5% 5% Construction and procurement 8% 4% Governance 8% 4% Third party activities 8% 2% We do not have any indication why there are reductions in the resources being brought into Internal Audit Departments. It may simply be a matter of availability and/or cost. We have, however, compared the qualifications of Internal Audit Departments recorded within the 2010 survey to the 2008 survey to see if qualifications among are increasing in some areas as a possible explanation. Page 3

Qualifications subject area Internal Auditors with Qualifications - 2008 Internal Auditors with Qualifications - 2010 Finance 80% 79% Information security 43% 49% Major projects 20% 15% Governance 13% 15% Taxation 15% 11% Business continuity 7% 7% Construction and procurement 6% 7% Health, safety and environment 9% 8% While there have been some increases in qualifications, notably information security, there is no overall trend and the results must be regarded as inconclusive. The table below provides an indication of how heads of internal audit acquire the additional resources the pattern of which is similar to that of 2008. Sources of additional resources Percent Purchased from specialist service providers 30% Co-sourcing with a third party 30% Independent experts from within the business ( guest auditors ) 15% Secondment staff from a third party 6% From other source (please specify in additional comments field) 6% Conclusions Despite the recession the demand for Internal Audit remains constant and is growing in some quarters. While we do not have evidence to support such a claim the pressure being placed upon organisations to improve governance, risk management and control may well be a contributory factor. Whatever the reason the prospects for internal auditors look favourable, albeit demanding. It would also appear that there is a healthy market for those people looking for part time opportunities. There is no formula for determining the size of an Internal Audit Department and the number of audits that must be carried out for a certain size of organisation. Every organisation is unique with different risks, stakeholder requirements, structure and operations. If there were such a formula we all would know about it by now. What we do know is that Internal Audit Departments must have a broad range of qualifications and experience to fulfil their role and responsibilities. The IIA qualifications along with financial qualifications appear to provide the core foundations but this is supplemented by a range of specialist knowledge and experience. Heads of Internal Audit do what they can to acquire and develop staff in these specialist skills but most, approximately 60%, acquire these from outside the Internal Audit Department. Our survey shows that there has been a slight reduction in these acquired skills since 2008 and time will tell whether this trend continues. Some key facts from the survey include: 60% of Heads of Internal Audit report to the Chief Financial Officer Page 4

The majority of Internal Audit Departments have between 1 and 4 FTEs, 44% of our survey The majority of part time staff work within small Internal Audit Departments, with 1 to 4 FTEs Only 4% of Internal Audit Departments surveyed have experienced a decrease in staffing 27% of Internal Audit Departments anticipate an increase in staff within the next year 79% of internal auditors have a finance qualification 60% of Internal Audit Departments bring in additional resources to complete their Internal Audit Plans 36% of Internal Audit Departments acquire resources for information security Page 5

Copy of survey issued to Service members Internal Audit Resources 2010 In the summer of 2008 the Institute surveyed HIAS members to understand how heads of internal audit resource their departments and to provide benchmark information for managers who are setting up or reviewing an internal audit function. We have decided to repeat the survey to gauge the impact of the financial crisis and subsequent recession on the size and structure of internal audit departments. 1) What is your industry sector (choose one from this list): Banks and building societies Insurance Other financial services Food and drink Manufacturing and engineering Media and leisure Retail Telecommunications Utilities High technology Other private sector Voluntary/charity Education Central government Local government Health Other public sector None of the above 2) What is the total number of employees in your organisation? (If your organisation is international or has multiple divisions, your answer should cover only that part of the organisation which your internal audit services cover) less than 101 101 to 200 201 to 500 501 to 1,000 1,001 to 2,500 2,501 to 5,000 5,001 to 10,000 10,001 to 25,000 25,001 to 50,000 over 50,000 3) What is the turnover or gross revenue spend of your organisation (provide the worldwide total for multinational organisations) up to 50 million or 57 million 51m - 100m or 58m - 115m 101m - 200m or 116m - 230m 201m - 350m or 231m - 402m 351m - 500m or 403m - 575m 501m - 1bn or 576m - 1.15bn 1bn - 5bn or 1.15bn - 5.75bn 5bn - 10bn or 5.75bn - 11.5bn Over 10bn or 11.5bn 4) Who do you report to for administrative purposes? Chief executive officer Chief financial officer Company secretary Other (please specify) If you selected other, please specify Page 6

Copy of survey issued to Service members 5) The IIA would like to record the size of your internal audit team to help us to better understand the internal audit market. If you are happy for us to do this please state your organisation's name. If not please leave the field below blank and move to the next question 6) How many full time equivalent internal audit staff (FTEs) did you have this time last year? 1-4 5-9 10-24 25-49 50-99 100+ 7) How many full time equivalent internal audit staff (FTEs) do you have now? 1-4 5-9 10-24 25-49 50-99 100+ 8) How many part time internal audit staff do you have now? 1-4 5-9 10-24 25-49 50-99 100+ 9) Please indicate the reason(s) for any increase or decrease in full time equivalent staff. IncreaseDecrease A change to the size and turnover of the organisation The development of risk management in the organisation A change to the risk profile of the organisation The need for specialist assurance providers A change to outsourced/cosourced arrangements Changes to the assurance needs of those responsible for governance 10) Within the next year do you anticipated there will be a change to the number of full time and part time staff within the internal audit department? No - resources will stay much the same Yes - there will be an increase in the overall number of staff Yes - there will be a decrease in the overall number of staff 11) Please indicate the reason(s) for the expected increase or decrease. IncreaseDecrease A change to the size and turnover of the organisation The development of risk management in the organisation A change to the risk profile of the organisation The need for specialist assurance providers A change to outsourced/cosourced arrangements Changes to the assurance needs of those responsible for governance Page 7

Copy of survey issued to Service members 12) What percentage of the internal audit department hold the following designations? 0 1-25%26-50%51-75%76-100%100% MIIA PIIA QiCA CIA CCAB (includes AAT) Other - (please specify in additional comments) 13) In which areas does your internal department have specialist qualifications and experience? QualificationsExperience Information security Telecommunications Business Continuity Finance Taxation Construction and procurement Governance Health, safety and environment Major projects Third party activities 14) Do you require resources in addition to staff to complete your internal audit plan? No Yes 15) What sort of resources do you use? Independent experts from within the business ( guest auditors ) Co-sourcing with a third party Secondment staff from a third party Purchased from specialist service providers From other source (please specify in additional comments field) Other (please specify) If you selected other, please specify Page 8

Copy of survey issued to Service members 16) Which specialist areas do the additional resources cover? Information security Telecommunications Business continuity Finance Taxation Construction and procurement Governance Health, Safety and Environment Major projects Third party activities Other (please specify) If you selected other, please specify 17) How many days are required to complete your annual internal audit plan? (This is the number of days allocated to audits rather than man days available) To nearest whole number eg 500 18) How many individual audits (assurance engagements and consulting engagements) are you planning to complete within the annual internal audit plan? 19) What percentage of available internal audit time is unallocated to provide a contingency? Don't Know None Between 1 and 5% Between 6 and 10% Between 11 and 15% Above 15% 20) What percentage of available internal audit time is allocated to the organisation's key risks? Don't Know None Between 1-25% Between 26-50% Between 51-75% Above 75% 21) Please add any other comments you may have about resourcing in your organisation Data Protection Notice Thank you for completing the survey, your views and opinions are very important. Your response will be treated in total confidence. Completed questionnaires will be processed only by the Institute of Internal Auditors - UK and Ireland (IIA) using Vovici EFM Continuum software and will not be disclosed to any other third parties. By submitting this questionnaire you consent to our processing of your sensitive personal data for these purposes. Page 9

Heads of Internal Audit Service Benchmarking Report Title of topic The Institute of Internal Auditors UK and Ireland The IIA is the only body focused exclusively on internal auditing and we are passionate about supporting, promoting and training the professionals who work in it. We have been leading the profession of internal auditing for over 60 years. The IIA plays an active role in the public arena, building awareness of internal auditing, promoting members interests and challenging organisations to reach the highest standards of corporate governance Our International Standards and Code of Ethics unite a global community of 160,000 internal auditors in 165 countries. We are committed to enhancing the recognition and professionalism of internal audit in the UK and Ireland, through: Dynamic leadership of the profession which maximises the reputation and influence of our members, both individually and collectively Setting performance benchmarks and promoting professional integrity through our International Standards and Code of Ethics Continually developing our qualifications so that their high quality and reputation is maintained, Providing technical resources, networking opportunities and support to our members throughout their careers Maintaining our position as the market leader in internal audit training Informing. Inspiring. Assuring. About Heads of Internal Audit Service benchmarking reports The IIA recognises that heads of internal audit need specialist information and support to help them respond to the demands of a competitive and increasingly regulated business climate. The Heads of Internal Audit Service is an exclusive service designed specifically for the leaders of the profession to keep them up to date, provide networking opportunities with like-minded professionals and to discuss successes and concerns in confidence with their peers. Other services include access to technical updates, a monthly e-bulletin, a programme of forum meetings and specifically commissioned research. The benchmarking reports are designed to help members make the most of the Service s networking opportunities. Service members can pose a question to other members to help them identify best practice on a particular issue. Questions for consideration can be emailed to chris.baker@iia.org.uk or technical@iia.org.uk Disclaimer This material is not intended to provide a definitive answer taddressing specific individual circumstances and as such is intended to be used only as a guide. The IIA recommends that you always seek independent expert advice relating directly to any specific situation. The IIA accepts no responsibility for anyone placing sole reliance on this guidance. www.iia.org.uk The Institute of Internal Auditors UK and Ireland Ltd 13 Abbeville Mews, 88 Clapham Park Road, London SW4 7BX Tel 020 7498 0101 Fax 020 7978 2492 Email technical@iia.org.uk Registered in England and Wales, no. 1474735 Information can be made available in other formats