The IIA Research Foundation Draft Internal Auditing Capability Maturity Model (IA-CMM)

1
The IIAResearch FoundationDraftInternal
Auditing Capability Maturity Model(IA-CMM)

• The ICGFM Conference
• Miami, Florida
• May 21, 2007

2
Presentation Outline

• The IIA and The IIA Research Foundation
• Draft IA-CMM
• Objectives
• Background
• Structure
• Underlying Principles
• Next Steps

3
The Institute of Internal Auditors (IIA)

• Established in 1941, The Institute of Internal
  Auditors (IIA) is an international professional
  association of more than 125,000 members in 160
  countries.
• Throughout the world, The IIA is recognized as
  the internal audit professions leader in
  certification, education, research, and
  technological guidance.

4
The Internal Auditing Capability Maturity
ModelObjectives

• GRC of The IIA recommended that an IA-CMM be
  developed as
• A basis for implementing and institutionalizing
  effective internal auditing in the public sector
• A roadmap for orderly improvement to strengthen
  capabilities

5
Capability Maturity Models Their History

• Based on Quality Management Principles
• Software Engineering Institute
• The original developers of capability maturity
  models TM
• Software
• Human Resource Management
• Office of the Auditor General of Canada
• Financial Management Capability Model

6
What is an IA-CMM?

• A tool that describes the key elements needed for
  effective IA
• Describes an evolutionary path for a public
  sector organization to follow in developing
  effective IA to meet its governance needs and
  meet professional expectations
• An advocacy tool to market IA to decision makers
• Model links to recommended practices at each
  level

7
Why in the Public Sector?

• IA varies widely from country to country
• Differences in culture, management practices and
  processes
• Need for a governance model including IA
• Opportunities to modernize/evolve IA, improve its
  effectiveness and deliver value added
• Critical need for a developmental model,
  especially in developing countries

8
What the IA-CMM will Provide When Completed

• A communication vehicle
• A framework for assessment
• A roadmap for orderly improvement

9

IA-CMM Capability Maturity Levels
LEVEL 5 Optimizing
LEVEL 4 Managed
LEVEL 3 Integrated
LEVEL 2 Infrastructure
LEVEL 1 Initial
10
Why Levels in a Capability Maturity Level?

• Different performance expectations and measures
  exist now
• Capacity gets built in steps/stages
• Need a common map/conceptual framework
• Roadmap to build capacity to achieve higher level
  of functionality
• Guidance to determine the capacity level that an
  organization wants/needs

11

IA-CMM Capability Maturity Levels
LEVEL 5 Optimizing
LEVEL 4 Managed
LEVEL 3 Integrated
LEVEL 2 Infrastructure
LEVEL 1 Initial
12
Typical Structure of a Capability Maturity Model

13
Institutionalizing a Key Process Area
14
Project Approach

• To explore and identify
• Characteristics of each capability level
• Elements that make up the internal auditing
  activity
• Key process areas at each capability level and
  within each element
• Goals that need to be achieved and activities and
  practices of each KPA that need to function
  effectively to move to next level

15
How will this be done?

• Through extensive consultation and validation
• Input from global, national organizations
  involved with governance, public sector auditing,
  internal auditing

16
Underlying Principles

• IAs Obligations
• IA is an integral component of effective
  governance in the public sector
• IA assists organizations achieve their objectives
  and account for their results

17
Underlying Principles

• An Organizations Obligations
• To determine the optimum level of internal
  auditing capability to support the required
  governance structures
• To achieve and maintain the desired capability

18
Underlying Principles

• Optimum Capability
• Three variables must be considered
• IA activity
• The organization
• The Environment
• Not every organization requires the same degree
  of capability or sophistication
• IA must be delivered in a cost-effective manner
• No one size fits all

19
IA-CMM

• Not prescriptive what should be done rather
  than how to do it
• A universal model with comparability around
  principles, practices and processes to improve IA
  and be applied globally

20
What the IA-CMM will Provide When Completed

• A communication vehicle
• A framework for assessment
• A roadmap for orderly improvement
• Progress over time

21
Next Steps

• Refine and validate the draft model
  globallybroad-based input
• Benchmarking partners
• Illustrative recommended and leading practices
• Completed IA-CMMNovember 2007
• Summary
• Implementation Workbook/s