Report on Key Compliance Attributes of the Internal Audit Function for the 2018 to 2019 Fiscal Year

1. Do internal auditors at TBS have the training required to do the job effectively, and are multidisciplinary teams in place to address diverse risks?

Yes, collectively, IAEB staff have the knowledge, skills and other competencies required to fulfill their responsibilities. The compliance attribute used to measure whether TBS has the training required is the percentage of staff:

• who have Certified Internal Auditor (CIA) or Chartered Professional Accountant (CPA) designations
• who are working to obtain a CIA or CPA designation
• who have other designations, such as:
• Certified Government Auditing Professional (CGAP)
• Certification in Risk Management Assurance (CRMA)
• Certified Fraud Examiner (CFE)

For the purposes of this report, 7 IAEB staff members are considered part of the TBS internal audit function. This staff includes:

• the chief audit executive
• the manager of the Government of Canada Audit Committee Secretariat
• professional practices staff
• internal audit managers
• auditors
• members who perform data analytics to support internal audits

Figure 1 shows the internal audit staff members by the designation or designations that they hold.

Legend
CIA: Certified Internal Auditor
CPA: Chartered Professional Accountant

Figure 1 - Text version

The pie chart shows the internal audit staff by the designation or designations that they hold as of May 31, 2019.

Certified Internal Auditor or Chartered Professional Accountant designations	43%
Both Certified Internal Auditor and Chartered Professional Accountant designations	29%
Other designations	14%
Remaining staff	14%

The IAEB values staff who have multidisciplinary backgrounds. The IAEB encourages the recruitment and development of talent who have diverse skill sets and backgrounds outside of auditing or accounting. Such talent includes staff who have:

• master’s degrees
• advanced knowledge of data analytics

2. Does the internal audit work performed conform with the international standards for the profession as required by Treasury Board policy?

Yes, the internal audit work performed by the IAEB conforms to the Standards. The IAEB maintains conformance by performing key activities such as the yearly quality assurance self-assessment exercise and the external quality assurance review, which occurs every 5 years. The IAEB periodically reports compliance attributes to the Government of Canada Audit Committee as part of a comprehensive briefing. A comprehensive briefing consists of an update on:

• the internal processes, tools and information considered necessary to evaluate conformance with the Institute of Internal Auditors’ Code of Ethics and the Standards
• the results of the IAEB’s Quality Assurance and Improvement Program

The IAEB’s last briefing to the committee about the results of the Quality Assurance and Improvement Program was in September 2018; the next briefing will be in June 2019.

Figure 2 - Text version

This timeline presents the key dates of the comprehensive briefings, external assessments and validation.

Key Dates	Related Activities
December 2016	An externally validated self-assessment
February 2017	A comprehensive briefing to the Government of Canada Audit Committee, including the results of the externally validated self-assessment exercise
September 2018	A comprehensive briefing to the Government of Canada Audit Committee, including the results of the quality assurance self-assessment exercise
June 2019	A quality assurance self-assessment exercise and a comprehensive briefing to the Government of Canada Audit Committee, including the results of the quality assurance self-assessment exercise (planned)
December 2021	An external validation (planned)

3. Are Risk-Based Audit Plans (RBAPs) submitted to audit committees and approved by deputy heads? Are they implemented as planned and are the resulting reports published? Is management acting on audit recommendations?

The internal audits conducted by the IAEB are planned based on the approved, multi-year Integrated Audit and Evaluation Plan. Projects are listed in a table that is maintained to track:

• planned internal audits
• progress in implementing actions as a result of internal audits

4. Is internal audit credible and adding value in support of TBS's mandate and strategic objectives?

The IAEB collects post-audit survey results to gauge management sentiments on the value of the internal audit services rendered. Due to timing, post-audit survey results for the joint audit and evaluation of privacy practices will be available later in the year and will be reported in next year’s key compliance attributes report.

The compliance attribute used to measure the credibility and value added by internal audit is an average overall usefulness rating from senior management, which is information gathered in the post-audit surveys issued to senior management.