Technical bulletin 2023: Internal audit key compliance attributes
Why publish key compliance attributes of internal audit
The objective of the Treasury Board Policy on Internal Audit is “to ensure that the oversight of public resources throughout the federal public administration is informed by a professional and objective internal audit function that is independent of departmental management.” It is important that the public know that heads of government organizations are receiving assurance and that activities are managed in a way that demonstrates responsible stewardship.
Departments with internal audit functions are required to meet public reporting requirements as prescribed by the Comptroller General of Canada (section A.2.2.3 of the Treasury Board Directive on Internal Audit) including:
- A.2.2.3.1 Performance results for the internal audit function
- A.2.2.3.2 A list of planned audit engagements for the coming fiscal year
The attributes in this report have been selected because they demonstrate to an external audience that, at a minimum, the fundamental elements necessary for oversight are in place, are operating as intended and are achieving results. The key attributes of compliance with the policy and standards are:
- internal auditors who are trained to effectively perform the work
- audit work that is performed in conformance with the international standards for the profession
- audit work that is performed according to a systematically developed risk-based audit plan, which has been approved by the head of the organization, and that results in management actions being taken in response to report recommendations
- audit work that is perceived by stakeholders as adding value in the pursuit of organizational objectives
Publishing departmental key compliance attributes provides information to Canadians and parliamentarians about the professionalism, performance, and impact of the internal audit function in departments. The attributes are not performance measures, and no targets are attached to them. Under the policy, the Comptroller General has the authority to amend these attributes in response to changes in the internal audit environment and/or due to the evolving maturity of the internal audit function.
Results of key compliance attributes
Performance indicator | Key compliance attribute | Fiscal year 2023 to 2024 (First quarter) |
Definition or comments |
---|---|---|---|
Do internal auditors in departments have the training required to do the job effectively? Are multidisciplinary teams in place to address diverse risks? | Number of internal audit employees |
20 | The number of current full-time equivalent positions |
Percentage of staff with an internal audit or accounting designation (Certified Internal Auditor (CIA), Chartered Professional Accountant (CPA)) |
55% | Not applicable |
|
Percentage of staff with an internal audit or accounting designation (CIA, CPA) in progress |
30% | In progress: The staff members (indeterminate employees) who have formally registered with and have been accepted by the certifying body to complete the requirements of the professional designation in a prescribed time frame and has registered for at least one component of the certification process. |
|
Percentage of staff holding other designations (for example, Certified Government Auditing Professional, Certified Information Systems Auditor) |
15% | Several staff also held other designations, for example:
|
|
Is internal audit work performed in conformance with the international standards for the profession of internal audit as required by Treasury Board policy? |
Date of last comprehensive briefing to the Departmental Audit Committee on the internal processes, tools, and information considered necessary to evaluate conformance with the Institute of Internal Auditors (IIA) Code of Ethics and the standards and the results of the quality assurance and improvement program (QAIP) |
August 2022 |
Last comprehensive briefing: A comprehensive briefing includes updates on all pertinent elements of the QAIP. In accordance with IIA Standard 1320, this comprehensive briefing would include:
|
Date of last external assessment |
March 2019 |
External assessments (practice inspections) must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization. |
|
Are the risk-based audit plans submitted to audit committees and approved by deputy heads implemented as planned with resulting reports published? Is management acting on audit recommendations for improvements to departmental processes? |
Refer to table below for internal audit status and related information for fiscal year 2023 to 2024. |
Not applicable |
Not applicable |
Is internal audit credible and adding value in support of the mandate and strategic objectives of the organization? |
Average overall usefulness rating from senior management (assistant deputy minister-level or equivalent) of areas audited |
82.6% | Average “overall usefulness” rating: Post-audit surveys to senior management of the area audited should include a question on the overall usefulness of the audit and should be done for all audits approved in the applicable fiscal year. |
Internal audit engagement status and related information for fiscal year 2023 to 2024
Additions and adjustments to planned internal audit engagements may occur in order to address emerging risks and priorities of the organization.
Internal audit engagements | Audit status | Report approved date | Report published date | Original planned management action plan (MAP) completion date | MAP implementation statusFootnote 1 |
---|---|---|---|---|---|
Horizontal Internal Audit Engagements | |||||
Blended Horizontal Engagement of Information Technology (IT) Security Part 1: Review of the IT Security Risk Management process supporting the Government of Canada (GC) Digital Direction (Advisory) |
Complete | November 9, 2020 | Not applicableFootnote 2 | March 31, 2021Footnote 3 | 67% Footnote 4 |
Blended Horizontal Engagement of IT Security Part 2: Small Departments IT Security Self-Assessment and Audit |
Complete |
April 7, 2022 |
October 3, 2022 |
March 31, 2024 |
Not applicableFootnote 5 |
Support for Departmental Internal Audits of Federal Government Consulting Contracts Awarded to McKinsey & Company and Summary of Results (Advisory) | Complete |
May 2, 2023 |
Not applicableFootnote 6 |
Not applicableFootnote 7 |
Not applicable |
Departmental Adoption of Digital Standards | Planned |
Not applicable |
Not applicable |
Not applicable |
Not applicable |
Small Departments Internal Audit Engagements | |||||
Core Control Audit: Veterans Review and Appeal Board | Complete | December 21, 2020 | February 12, 2021 | September 30, 2021 | 38%Footnote 8 |
Core Control Audit: Immigration and Refugee Board | Complete |
May 3, 2023 |
Not applicableFootnote 9 |
March 31, 2024 |
Not applicableFootnote 10 |
Core Control Self-Assessment Consolidated Results Report - Delegation & Transfer Payments (Advisory) | In Progress |
Not applicable |
Not applicableFootnote 11 |
Not applicableFootnote 12 |
Not applicable |
Targeted Annual Core Control Self-Assessment Audit - Delegation & Transfer Payments | In progress |
Not applicable |
Not applicable |
Not applicable |
Not applicable |
Core Control Self-Assessment Consolidated Results Report – Contracting, PAYE, Receivables (Advisory) | Planned |
Not applicable |
Not applicableFootnote 13 |
Not applicableFootnote 14 |
Not applicable |
Horizontal Engagement in Small Departments of Contracting | Planned |
Not applicable |
Not applicable |
Not applicable |
Not applicable |
Regional Development Agencies Internal Audit Engagements | |||||
Regional Relief and Recovery Fund (RRRF) Fraud Risk Assessment (Advisory) | Complete | October 24, 2022 | Not applicableFootnote 15 | Not applicableFootnote 16 | Not applicable |
Page details
- Date modified: