Maintaining control: will a boom in internal auditing result in a bust in audit quality?

THE INTERNAL CONTROL audit requirements of Section 404 of the U.S. Sarbanes-Oxley Act of 2002 are driving a head-count increase in public accounting firms, both for the firms' external and internal audit practices. U.S. corporations of all sizes have significantly increased their use of the certified public accountant (CPA) firms to support their Section 404 internal control testing.

In October, Business 2.0 magazine listed the top U.S. organizations in terms of hiring. Numbers six through eight were:

* Ernst & Young hired 7,000 new people in the last 12 months and plans to hire 9,300 more during the next year.

* Deloitte hired 6,000 new employees last year and plans to hire 9,500 in the coming year.

* PricewaterhouseCoopers hired 5,500 last year and plans to hire 7,000 in the next 12 months.

It is not just the large firms that are growing. All sizes of CPA firms are starting or expanding their internal audit co-sourcing practices, as are the "independent" providers like Protiviti and Jefferson Wells. Even organizations that until now have specialized in information technology (IT) consulting (e.g., Taos Mountain Inc. and SAS Institute Inc.) are selling Section 404 audit services.

This tremendous increase in demand for auditors presents several diverse challenges for the leaders of our profession.

DILUTION OF TALENT It is getting more and more difficult to find knowledgeable auditors, whether to hire directly into an internal audit function or indirectly through a co-sourcing partner. The temptation is to hire the best of what is available; however, that practice may result in future personnel and customer service problems. Instead, audit directors need to be very sure of their staffing needs and carefully select employees. For example, audit directors who need staff to perform Section 404 controls testing should ensure that they only hire individuals with solid workpaper preparation skills. This is especially true for IT auditors. Section 404 dramatically increases the requirement to complete quality workpapers, typically doubling the time required to test the average control.

IT auditors who are really only good technicians are flooding the market. They have limited audit skills and no idea how to document their work. This presents the risk that, although quality technical work is performed, when the external auditors review it, it may be found deficient for one of several reasons, including:

* It is not clear what work was performed and what transactions were tested, so the test cannot be reperformed.

* It is not clear how the sample size to test was determined, and therefore was insufficient.

* The auditor did not explain how he or she came to the conclusion that the control was operating effectively.

Once an audit director's needs are well-defined, he or she should test candidates to ensure that they meet current needs or, if not, can develop or be taught required skills.

The same disciplined approach to hiring is critical when using a co-sourcing provider. Do not assume the co-source partner has people with the necessary skills and experience. The staff may lack the specific audit and workpaper skills needed. Practitioners should interview--or at least review the resumes of--the staff the co-source partner is planning to put on the job.

DILUTION OF AUDIT MANAGEMENT Just as finding good employees is difficult, so is managing them. Inexperienced people require more management time, and good management is critical when staff work requires careful review, as with Section 404 testing.

The co-sourcing providers are hiring experienced internal audit directors and managers. However, there are two dangers. First, the managers are working on multiple projects for numerous clients and may not be monitoring the work closely. Second, people may be promoted to management earlier than they ordinarily would.

The answers are clear, but not easy. More time must be allocated to managing junior staff, as well as to supervising less experienced managers. When outsourcing work to a partner firm, organizations should ensure that they understand how much management time is included and how much experience the manager has.

DILUTION OF INTERNAL AUDIT VALUE Increased demand for resources without a corresponding increase in supply inevitably leads to an increase in prices. My own experience is that the prevailing hourly rate from the large CPA firms has nearly doubled in the last year. While the demand to hire internal staff has increased, employers' reluctance to let salaries grow at the same rate means that the cost of hiring new staff has gone up much less.

The implication is obvious: It is increasingly uneconomical to outsource work. I predict that companies will try to limit the work they outsource in 2005. They cannot afford to have internal audit costs spiral out of control while receiving less value from the function. The pressures to cut head-count to limit cost increases are inevitable. Practitioners should seek alternative staffing methods.

This is an interesting opportunity for The IIA. As business leaders, chief audit executives (CAEs) are responsible for ensuring internal audit services are not only of high quality, but are a good value. Now would be a good time for an IIA Practice Advisory guiding CAEs on how to build staffing models, taking into account both the cost and value of alternate staffing strategies. For example, how much and which services should be kept in-house versus being outsourced? Is it practical to move the entire, or at least a major part of, the internal audit staff offshore to take advantage of lower staffing costs?

DILUTION OF THE PROFESSION I have been a consistent user of co-sourced internal audit services, but I am becoming concerned that the CPA firms providing those services may not be playing by the same rules as practitioners. The contracts that the larger CPA firms are asking practitioners to sign do not indicate that their internal audit services are compliant with The IIA's International Standards for the Professional Practice of Internal Auditing (Standards). Instead, they state that their services are in accordance with American Institute of Certified Public Accountants (AICPA) consulting standards. The CPA firms are reluctant to present opinions on the adequacy of the internal controls addressed in their audits, because that is inconsistent with the consulting standards.

This presents problems. First, the practitioner must understand what he or she will be getting. Although the chief executive officer and chief financial officer--and the progressive CAE--must provide an opinion on internal controls, the co-sourced internal audit provider is often reluctant to do so. The co-sourcer will report control deficiencies, but will rarely express an opinion as to whether the controls are adequate. That should be of concern if the practitioner is asking a partner firm to perform internal controls testing for Section 404.

The audit committee and executive management of organizations outsourcing internal auditing to one of the large CPA firms should think twice before allowing those organizations to avoid expressing an opinion on internal controls. It is increasingly common and good practice for an internal CAE to provide the board and executive management with assurance on internal controls by giving his or her opinion on their adequacy. It is unsatisfactory for an outsourced provider to do any less.

The IIA should be very concerned. How can The Institute profess to be the standards providers and leaders when such a large and growing percentage of internal audit practitioners profess to be following the AICPA's standards and not The IIA's? Now is the time for action, before it is too late to change minds as well as practices.

Although The IIA's strategic plan includes an advocacy initiative for 2005 that addresses some of these issues, in my opinion, The Institute must make the following a priority this year:

* Set a goal that by the end of 2005 the AICPA will recognize The IIA's Standards as applicable to all internal audit services provided by its member firms.

* Form a task force with leading practitioners, IIA staff, and at least one representative partner from each of the large CPA firms, as well as representatives from major national/regional internal audit service providers. The group should develop and execute a plan, such that the previously stated goal can be achieved. The task force can then evolve into a committee to address future coordination issues with the AICPA. For example, will the CPA firms engage in quality assurance audits to measure and report on their compliance with the Standards?

* Provide CAEs guidance on how to structure contracts with internal audit service providers, such that the latter will provide opinions and perform their work in accordance with the Standards.

* Provide audit committees and corporate executives guidance on how to negotiate contracts with internal audit service providers and the difference between the AICPA consulting standards and The IIA's internal audit standards.

When growth is booming, it is easy to focus on short-term objectives. For many of us, the current goal is to "get through Section 404." But, we all--practitioners, board members, corporate executives, and the leaders of our profession--cannot allow that short-term focus to prevent us from taking the steps necessary to stay in control of the practice and profession of internal auditing. That practice has to be a quality practice, performed at an economical cost and in accordance with The IIA's Standards.

To comment on this article, e-mail the author at [e-mail].