Why Larry's IA Checkup?

Based on my experiences in performing QAR’s and validations of self-assessment efforts, and discussions with others, most traditional external QAR processes have many shortcomings:

Typical Three Day Agenda (for Medium and Large Shops):

• Preparation: Electronic survey of auditors
• Day 1: Comments on audit reports; Review of audits, annual audit planning (AAP), metrics, IT approach; CSA workshop
• Day 2: Comments on individual audits, AAP, metrics, IT; Discuss draft report
• Day 3: Training seminar in relevant topics.
• Post: Finalize report

Typical One or Two Day Agenda (for Small Shops):

• Preparation: Electronic survey of auditors (if needed)
• Day 1: Discuss audit reports, AAP, metrics, IT approach; Review of audits
• Day 2: One-on-one training related to audits, AAP, metrics, IT; Discuss draft report
• Post: Finalize report
  
  

Audit Department Preparation:

Preparation (before on-site work): Supply five audit reports, one report to audit committee or similar, copy of audit manual and annual audit plan; Participate in one hour conference call at least two weeks before on-site work to begin survey process and discuss logistics.

Simple, Fixed Fee Pricing:

Other Benefits:

QAR Beliefs

Before I come on-site, you should know some things about how I view QAR's. These are at the core of Larry's IA Checkup. I believe:

• QAR’s should be a positive, value-adding experience for the internal audit department. A QAR should leave the audit department with a good feeling about the process.
• The worst outcome for a QAR is a report containing an evaluation or suggestions that a good audit department disagrees with. Because of the power that resides in an external reviewer, in an inflexible approach, the internal audit department might be required to accept and implement suggestions with which they absolutely disagree. This would be a mistake.
• A constant question on a QAR should be “What do the Standards say?” as that is the measure of conformity rather than the personal opinion or experience of any one reviewer. In general the Standards allow for many alternative methods of complying in any area. Such an approach is different than a “by the books” review which does not entertain real-world, necessary variances in approach.
• Reviewing working papers, while an essential step of a QAR, is actually not as important as open discussions with auditors about how they do their audits.
• While a QAR team should be flexible, the spirit of the Standards must be understood and achieved and effective measures employed by internal auditing to provide a high level of assurance to detect fraud, waste and abuse in the audit effort.
• An effective, internal quality control and assurance process is essential to achieving compliance with the Standards.
• Smaller audit shops are different than larger shops, and have a different level of formality in their audit manual and other procedures. I understand that.
• Finally, neither an audit nor a QAR should be a game of “second guessing” those actually performing the work. The passage of time makes many things clear that were not clear at the time work was performed. Auditors and reviewers must keep this in mind during their work. This means reviewers should give positive feedback and credit when an audit department finds and addresses quality problems in an ongoing manner. That is a good event, to be positively viewed, and those items in process of being corrected do not need to be criticized during the QAR.