Technical bulletin 2020: Internal audit key compliance attributes

Why publish key compliance attributes of internal audit

The objective of the Treasury Board Policy on Internal Audit is “to ensure that the oversight of public resources throughout the federal public administration is informed by a professional and objective internal audit function that is independent of departmental management.” It is important that the public know that heads of government organizations are receiving assurance and that activities are managed in a way that demonstrates responsible stewardship.

Departments with internal audit functions are required to meet public reporting requirements as prescribed by the Comptroller General of Canada (section A.2.2.3 of the Treasury Board Directive on Internal Audit) including:

A.2.2.3.1 Performance results for the internal audit function
A.2.2.3.2 A list of planned audit engagements for the coming fiscal year

The attributes in this report have been selected because they demonstrate to an external audience that, at a minimum, the fundamental elements necessary for oversight are in place, are operating as intended and are achieving results. The key attributes of compliance with the policy and standards are:

internal auditors who are trained to effectively perform the work
audit work that is performed in conformance with the international standards for the profession
audit work that is performed according to a systematically developed risk-based audit plan, which has been approved by the head of the organization, and that results in management actions being taken in response to report recommendations
audit work that is perceived by stakeholders as adding value in the pursuit of organizational objectives

Publishing departmental key compliance attributes provides information to Canadians and parliamentarians about the professionalism, performance and impact of the internal audit function in departments. The attributes are not performance measures, and no targets are attached to them. Under the policy, the Comptroller General has the authority to amend these attributes in response to changes in the internal audit environment and/or due to the evolving maturity of the internal audit function.

Due to the Covid-19 pandemic, the publication deadline for the internal audit key compliance attributes was delayed to October 31, 2020.

Results of key compliance attributes
Performance indicator	Key compliance attribute	Fiscal year 2020 to 2021 (First quarter)	Definition or comments
Do internal auditors in departments have the training required to do the job effectively? Are multidisciplinary teams in place to address diverse risks?	Number of internal audit employees	25	The number of current full-time equivalent positions
	Percentage of staff with an internal audit or accounting designation (Certified Internal Auditor (CIA), Chartered Professional Accountant (CPA))	48%	n/a
	Percentage of staff with an internal audit or accounting designation (CIA, CPA) in progress	24%	In progress: The staff member (an indeterminate employee) has formally registered with and has been accepted by the certifying body to complete the requirements of the professional designation in a prescribed time frame and has registered for at least one component of the certification process.
	Percentage of staff holding other designations (for example, Certified Government Auditing Professional, Certified Information Systems Auditor)	24%	Several staff also held other designations, for example: Certified Government Auditing Professional Certified Information Systems Auditor Certified Fraud Examiner Certification in Risk Management Assurance Certification in Control Self-Assessment
Is internal audit work performed in conformance with the international standards for the profession of internal audit as required by Treasury Board policy?	Date of last comprehensive briefing to the Departmental Audit Committee on the internal processes, tools, and information considered necessary to evaluate conformance with the Institute of Internal Auditors (IIA) Code of Ethics and the standards and the results of the quality assurance and improvement program (QAIP)	October 2020	Last comprehensive briefing: A comprehensive briefing includes updates on all pertinent elements of the QAIP. In accordance with IIA Standard 1320, this comprehensive briefing would include: the scope and frequency of both the internal and external assessments the qualifications and independence of the assessor(s) or the assessment team, including potential conflicts of interest conclusions of assessors corrective action plans External assessments (practice inspections) must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization.
	Date of last external assessment	March 2019
Are the risk-based audit plans submitted to audit committees and approved by deputy heads implemented as planned with resulting reports published? Is management acting on audit recommendations for improvements to departmental processes?	Refer to table below for internal audit status and related information for fiscal year 2020 to 2021.	n/a	n/a
Is internal audit credible and adding value in support of the mandate and strategic objectives of the organization?	Average overall usefulness rating from senior management (assistant deputy minister-level or equivalent) of areas audited	87.5%	Average “overall usefulness” rating: Post-audit surveys to senior management of the area audited should include a question on the overall usefulness of the audit and should be done for all audits approved in the applicable fiscal year.

Internal audit engagement status and related information for fiscal year 2020 to 2021

Additions and adjustments to planned internal audit engagements may occur in order to address emerging risks and priorities of the organization.

Internal audit engagements	Audit status	Report approved date	Report published date	Original planned management action plan (MAP) completion date	MAP implementation status^{table 2 note 1}
Horizontal Internal Audit Engagements
Blended Horizontal Engagement of Information Technology (IT) Security Part 1: Review of the IT Security Risk Management process supporting the Government of Canada (GC) Digital Direction (Advisory)	In progress	n/a	n/a	n/a	n/a
Blended Horizontal Engagement of IT Security Part 2: Small Departments IT Security Self-Assessment and Audit	In progress	n/a	n/a	n/a	n/a
Blended Horizontal Engagement of IT Security Part 3: Review of the Effectiveness of User Awareness and Training and Incident Detection (Advisory)	In progress	n/a	n/a	n/a	n/a
Audit of Project Management	In progress	n/a	n/a	n/a	n/a
Departmental Implementation of Digital Standards	Planned	n/a	n/a	n/a	n/a
Treasury Board Submission Information for Decision-Making	Planned	n/a	n/a	n/a	n/a
Small Departments Internal Audits
Core Control Audit: Administrative Tribunals Support Services of Canada	Published – MAP not fully implemented	June 26, 2019	July 29, 2019	December 31, 2019	20%^{table 2 note 2}
Core Control Audit: Veterans Review and Appeal Board	In progress	n/a	n/a	n/a	n/a
Regional Development Agencies Internal Audits
Atlantic Canada Opportunities Agency Assessment of Innovation Capacity (Advisory)	Approved – Not published^{table 2 note 3}	July 11, 2019	n/a	n/a^{table 2 note 4}	n/a
Canada Economic Development for Québec Regions Assessment of Innovation Capacity (Advisory)	Approved – Not published^{table 2 note 3}	October 8, 2019	n/a	n/a^{table 2 note 4}	n/a
Regional Relief and Recovery Fund (RRRF) Fraud Risk Assessment	Planned	n/a	n/a	n/a	n/a
Other Internal Audit Engagements
Office of the Comptroller General Special Internal Audit (Due to the nature of this audit, the details cannot be released at this time)	Approved – Not published^{table 2 note 5}	September 1, 2020	n/a	n/a	n/a^{table 2 note 6}
Table 2 Notes Table 2 Note 1 In accordance with the Treasury Board Directive on Internal Audit, the OCG has established and maintains a system to determine whether the actions scheduled by management in response to audit recommendations have been implemented. For federal government departments without an internal audit function, including most small departments and regional development agencies, the OCG performs an annual MAP monitoring exercise related to OCG-led audits. The implementation of MAPs is rated on a scale of 1- Planning Stage to 5- Fully Implemented. The results of which are verified by the OCG and presented at least annually to the Small Department Audit Committee. For federal government departments with an internal audit function, the responsibility for monitoring MAPs, including MAPs stemming from audits performed by the OCG, rests with their respective Chief Audit Executive. The MAP implementation status reported in this table is the percentage of MAPs that have been assessed and validated by OCG as level 5-Fully Implemented. Return to table 2 note 1 referrer Table 2 Note 2 This is the MAP implementation status as at the last MAP monitoring exercise completed in FY 2019-20 Quarter 3; therefore, the current implementation status may be higher. The implementation status will be validated during the next MAP validation exercise. Return to table 2 note 2 referrer Table 2 Note 3 Due to the advisory nature of this engagement, and in accordance with the Treasury Board Policy on Internal Audit, this engagement report will not be published. Return to table 2 note 3 referrer Table 2 Note 4 There is no MAP for this advisory engagement. Return to table 2 note 4 referrer Table 2 Note 5 In accordance with the Treasury Board Policy on Internal Audit, this engagement report is in the process of being published. Return to table 2 note 5 referrer Table 2 Note 6 The Office of the Comptroller General is not responsible for monitoring the implementation of MAPs associated with this audit. Return to table 2 note 6 referrer

Page details

Date modified:: 2020-10-30

Language selection

Search

Technical bulletin 2020: Internal audit key compliance attributes

Why publish key compliance attributes of internal audit

Table 2 Notes

Page details