CBOK Report: Benchmarking Internal Audit Maturity

A High-Level Look at Audit Planning and Processes Worldwide

How mature is your internal audit department (or how mature can it be)? This subject is explored using responses from more than 2,500 chief audit executives (CAEs) in The IIA’s CBOK (Common Body of Knowledge) database. The findings were further supplemented through interviews with a small sample of CAEs from different regions in the world who commented on internal audit department maturity.

Assessment of the internal audit department maturity is important because it helps build strategies to bridge the gaps between expected and realized internal audit quality. Maturity indicators are introduced to support principal stakeholders in deciding whether and how they can rely on internal audit departments’ services and guide CAEs in developing more mature internal audit departments.

This report spans various industries in several global regions. It also reports on the influences of internal audit departments’ age and size, organization size, and degree of conformance with The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards), among others. The report is organized in seven sections. Data was available to measure internal audit departmental maturity on the following indicators:

• Is almost fully aligned with the strategic plan of the organization
• Demonstrates agility and flexibility to adapt the internal audit planning and priorities to important changes in the strategic objectives of an organization
• Relies on a holistic risk assessment to build sufficient knowledge and understanding of the organization’s business at micro and macro levels
• Has an internal audit staff with a mixed background of traditional auditing skills and industry knowledge complemented with general business competence, critical thinking, and leadership skills
• Provides structured, documented, and diversified training programs for the internal audit staff
• Documents and continuously monitors the audit procedures to adapt them to the evolving environment
• Makes the internal audit strategy explicit and translates the strategy into key performance indicators (KPIs), which allow continuous monitoring of the achievement of the internal audit strategy
• Uses leading technology (like data mining, data analytics, and continuous/ real-time auditing) across the entire audit process to increase internal audit’s efficiency and effectiveness
• Has a Quality Assurance and Improvement Program (QAIP) for the internal audit department, which is aligned with the internal audit strategy and supported by a culture around continuous quality assurance and improvement

In addition to these main findings, key action items are included in each section to help establish guidance in improving internal audit department maturity.