The Institute of Internal Auditors presents all things internal audits. In this episode, the i i, a director of Professional practices, Pamela Strobel Powers discusses the new Rerelease 2024 Global internal Audit standards with an emphasis on the public sector. She explores the changes, challenges, and resources available to help internal auditors adapt to these updates. Hi, Pam. Wonderful to see you. Thanks for sitting down and talking with me today. Thank you for having me, Logan.
Obviously, one of the biggest topics that we've had at the i a is the, is the release of our awaited global new, new global audit standards. Um, and we really kind of wanna take time with you and also our other experts to really kind of understand what it is about them that are different. What are some of the things people need to take pay attention to? Um, so obviously one of the best places that we can start is looking at it from the public sector perspective.
Is this really the first time the public sector has been explicitly referenced in the standards? Actually, yes. While the standards were always written with the intention of being for any size of internal audit function in any sector or any industry, um, therefore the public sector has always been an implicit consideration in the standards.
In this iteration, we really wanted to listen to our members and recognize the specific nuances and challenges and that in particular, the public sector has had in implementing and conforming to the global internal audit standards in the same way as private sector organizations do.
Um, therefore, in having those conversations, we develop the explicit, um, public sector considerations and have included them in the section that is at the end of the new standards titled Applying the Global Internal Audit Standards in the Public Sector. Now that we're kind of in that place where people are really starting to, to look seriously at them.
Um, from your perspective, what do you feel, um, in the public sector realm are the biggest changes in additions from the standards that are gonna require the most attention from them? I've been out a lot making a lot of specifically to public sector audiences, presentations on the updates. I've had a lot of conversations and I've lot received a lot of questions.
Um, I personally from that, think one of the biggest changes that's making an impact are those changes specifically to domain three, the governing the internal audit function. Um, and this in particular is because the governance structure of most public sector organizations varies quite significantly from the private sector, and it even varies jurisdiction to jurisdiction.
Um, and between levels of government, for example, multinational organizations, national or federal organizations, regional, local, um, even those government sponsored and funded organizations, some of those challenges are that it might not always be clear to a public sector internal audit function who specifically makes up that governing body.
Um, that's what is referred to as the board and the standards, but in the public sector, governing body resonates a little bit better with all of our audiences.
Um, who specifically makes that up for an internal audit function, there might be split or multiple reporting lines for a public sector internal audit function, and not all functions have the same, may have the same opportunities for being able to schedule time or even have access to those governing body members to have the conversations that we've now required within the standards.
Is there anything in the domain, um, that kind of directly refers the challenges the public sector faces with governing bodies or audit committee relations? I think so. I think, um, a related challenge in the public sector, um, again, might be with those governing bodies, or even if the organization has an audit committee, um, such as being able to establish that needed buy-in from governing body members.
Those sometimes in the public sector might even be elected officials who might not be able to fully see the value of serving on such a committee, or they might not fully understand the role of the public sector internal audit function. Um, also some leadership teams might be concerned with having audit committee members that are external to their organization.
Um, there are natural concerns with information being disclosed publicly or outside members being able to fully understand their business and operations within the public sector. There's now an even greater impetus for internal audit functions to be able to promote the important role of the governing body serves as oversight to the internal audit function.
And then, and specifically now in, um, how meeting the essential conditions that are outlined in the standards in domain three, the governing body has such an important role in helping to ensure the effectiveness of the internal audit function, um, and therefore also the importance of that relationship between the chief audit executive and the governing body. It's something that the I I A has always stressed, but now it's absolutely imperative.
How much of an adjustment do you feel, um, is needed from public sector functions to comply with these changes? You know, how long should it take and is there something in these requirements that requires a high level of concern? As you know, the new standards were released in very early January of 2024, and therefore become effective one year later in January of 2025.
Personally, I think a year is about right for internal audit functions to be able to, uh, look at those new standards and get themselves in performance. But I certainly can empathize with that being considered a challenge. Um, one concern that I've heard expressed is, um, is there a consideration for public sector organizations that might follow a fiscal year or something other than the traditional calendar year, um, such as July 1st to June 30th?
Um, and the formal answer is no. Um, however, internal audit functions are in control of when they schedule their external quality assessment, um, functions should today be performing a gap or readiness assessment, um, and working to get into conformance and having, again, those conversations we just talked about with their governing bodies or audit committees around areas where there might be more work to be done to get into conformance if the audit function has had an
external quality assessment according to the 2017 standards, there now is a tool available on the I'S website, uh, we just issued it about a week ago, that will help with that assessment. It's called con, a Conformance Readiness Assessment Tool. By performing such an assessment, chief audit executives then might wanna consider, uh, creating action plans and prioritizing the work that they need to be done to achieve full conformance before they schedule their next external quality assessment.
Another consideration, and this one certainly isn't only for the public sector, but it's definitely prevalent for smaller internal audit functions, and I do tend to find a lot of internal audit functions within the public sector are smaller. Um, there is a bit of a perception that some of the new standards might take, um, more time away from the important work that internal auditors are doing in providing assurance and advisory services within their organizations.
Um, internal audit functions will certainly need to be able to balance the efforts they're putting towards implementing the new standards with also conducting that work. Um, and they'll need to be reasonable about that approach. Uh, but there are some strategies that they can consider. Um, for example, uh, as you may know, Le Logan, the um, strategic plan is a new, uh, standard.
It was implied previously in the previous standards, but now it is a full requirement, that strategic plan, um, especially for a small internal audit function in a small organization, certainly there's no requirement that it be, say, 25 pages long. Um, a simple single page outlining the purpose and the objectives of the internal audit function as aligned with the organs obje organization's objectives will absolutely fit for that requirement. These new requirements, these new extra steps.
How will these changes work in the long term to future proof public sector internal audit functions? You know, what, what benefits beyond just, you know, conformance should internal audit functions in the public sector see from these changes? As we know, following standards is one thing that helps internal auditors in establishing credibility with our key stakeholders in leadership in our organizations, um, and in some ex uh, public sector cases, leadership, uh, outside the direct organization.
Um, this iteration of the standards focused on improving performance of the internal audit function, not just conformance with a set of standards. And the purpose was that is to be able to, um, help increase the value that internal audit functions provide to their organizations. Implementing these new standards is a real opportunity to be able to raise the bar in earning the trust of our key stakeholders and increasing and improving the value of our internal audit work.
Some of the new and revised standards, um, will also assist with transparency of internal audit work, and that's a big deal in the public sector. Um, for example, the strategic plan that I mentioned previously, as well as another new requirement in establishing performance measures. Those performance measures help the internal audit function be able to tell the story of how internal audit work is performing to its objectives and purpose.
Obviously, when we create the standards, we always have, uh, an eye to our global applicability. You know, the standards are meant to be universal.
They're designed to be achievable by anyone regardless of function, size, industry, region, um, but obviously there, you know, there's some gray area there that everyone has to look at, you know, so are there any noticeable public sector characteristics in a certain region or location, uh, that might make, um, aspects of these new co conformance requirements a unique challenge to them?
Of course, in some areas there we are going to see stronger splits between central governments, regional and local governments. Um, that could further complicate the ability to both define and communicate again, with that governing body that has the direct oversight of the internal audit function, um, such as we discussed previously. And of course, in the public sector, we'll see turnover in the private sector as well, but in the public sector, we have forced turnover due to, um, uh, elections.
So, uh, many governments see a lot of turnover as well as, um, it's no secret that, uh, we see budgetary struggles, um, anytime there are economic impacts that may impact the private sector as well. We're definitely going to see that trickle down. It might be a little bit of a time lag, but you'll see that trickle down and impact the public sector, what as well. And that will, IM, um, in turn impact resources available for internal audit.
Um, this is another reason why it's so important to be able to have those communications with the governing body in order to make sure they have a strong understanding, um, understanding of the need to be able to meet those essential conditions that are outlined in domain three.
Um, it's so important that they understand and, and then carry out their role to help advocate for resources for the internal audit function so that the internal audit function can fulfill its mandate, um, within the public sector.
Um, budgetary authority may not be with that governing body or with the audit committee, however, those members can certainly, um, create a very valuable role in being able to advocate and have those conversations with those people who do hold that budgetary authority In the public sector, uh, world.
Um, is there anything that the we are offering in terms of resources from the i a that anyone in the public sector might wanna seek out if we didn't answer one of their questions here or, uh, or they just maybe just want some more information? Of course. I'm so glad you asked.
Um, for everyone, we have set up a whole standards knowledge center on our website, um, that's dedicated to the new standards and includes, um, related tools that have been issued so far more to come, uh, but including so far, we have the crosswalk between the 2017 standards and the newly released 2024 global internal audit standards. Also a helpful tool in that gap or readiness assessment.
Um, however, also specific to the public sector, um, so far we've issued a model internal audit charter that can be customized to fit any individual organization speci specific circumstances. Um, currently we are in the process of updating our existing global guidance, um, so be watching for updated public sector general guidance, as well as, of course, our global technology audit guides that are helpful for anyone. Fantastic. And, uh, Pam, I think we're almost out of time.
Um, but it was really great talking with you. I know you and I are gonna be working together a lot in the coming year. Um, we'll probably be contributing a lot to our public sector, unlike exclusives, the Internal Auditor Magazine website. Shameless plug for me. Um, but, uh, those are all just exciting things to, to look forward to from the public sector. Um, really thank you so much for sitting down with me. It's, it's always a pleasure. I always learn so much.
Um, and I hope you enjoyed it as much as I did. Of course. Thank you, Logan. Um, I always enjoyed talking with you as well, and I especially appreciate the opportunity to highlight these updates for our public sector members and users of our standards. If you like this podcast, please subscribe and rate us. You can subscribe wherever you get your podcasts. You can also catch other episodes on YouTube or@theiia.org. That's THE iia.org.