Compliance Attributes for the Internal Audit Function - September 2023
Key compliance attributes are published in accordance with the Office of the Comptroller General of Canada (OCG) Technical Bulletin 2023-1: Policy on Internal Audit. It states that:
A.2.2.3 Departments must meet public reporting requirements as prescribed by the Comptroller General of Canada.
These key compliance attributes demonstrate that the fundamental elements necessary for oversight are in place, are performing as required under the Policy on Internal Audit and the Directive on Internal Audit, and are achieving results.
Key Compliance Attributes
Professional Qualifications
Members of the internal audit team are trained to do their job effectively. Multidisciplinary teams are in place to address diverse risks. The breakdown of the internal audit staff professional qualifications is shown in Figure 1.
The bubble chart shows the breakdown of the internal audit staff qualifications as of September 30, 2023.
- Certified Internal Auditor (CIA)/Chartered Professional Accountant (CPA) Designations: 50%
- Accounting or other designation in progress: 25%
- Other Designations: 0%
- CRM: Canadian Risk Management
- CRMA: Certification in Risk Management Assurance
- CISA: Certified Information Systems Auditor
- CGAP: Certified Government Auditing Professional
- PMP: Project Management Professional
Text alternative for Figure 1. Internal audit staff qualifications as of September 30, 2023
- 50% of the audit team has CIA/CPA Designations
- 25% of the audit team has an accounting or other designation in progress
- 0% of the audit team has another designation (CRM/CRMA/CISA/CGAP/PMP)
Conformance with the International Standards
The Audit and Assurance Services Branch’s internal audit work conforms to international standards for the profession. The last external audit assessment was completed in May 2022. The most recent internal assessment was presented on December 13, 2021, at the Departmental Audit Committee. The presentations consisted of an update on:
- The scope and frequency of both the internal and external assessments
- The qualifications and independence of the assessor(s) or assessment team, including whether or not there were any potential conflicts of interest
- Conclusions of assessors
- Corrective action plans
- Internal process, tools and information considered necessary to evaluate conformance with the Institute of Internal Auditor’s Code of Ethics and Standards
- Results of the Internal Audit Branch’s Quality Assurance and Improvement Program
The internal audits conducted by the Audit and Assurance Services Branch are planned and based on the approved Risk-Based Audit Plan. The audits and the implementation status of their Management Action Plan (MAP) are listed in Table 1. Additions and adjustments to the internal audits may occur in order to address emerging risks and priorities of the organization.
| Internal Audit Title | Status | Report Approved Date | Report Published Date | Original Planned MAP Completion Date | MAP Implementation Status |
|---|---|---|---|---|---|
| Audit of IT Security (Focus on Cybersecurity) | Approved – Not published: MAP not fully implemented | September 14, 2021 | N/A | June 30, 2022 | 80% implemented |
| Audit of Internal Controls Over Financial Reporting | Published: MAP fully implemented | September 27, 2022 | May 5, 2023 | December 31, 2022 | 100% implemented |
| Audit of Oversight Mechanisms for Self-Government Financial Mandating | Published: MAP not fully implemented | December 15, 2022 | June 20, 2023 | June 30, 2024 | 0% implemented |
| Audit of the Northern Contaminated Sites Program | Approved – Not published; MAP not fully implemented | May 25, 2023 | October 31, 2024 | 0% implemented |
|
| Audit of Exceptional Contracting Limits Authority | Approved – Not published: No MAP | September 26, 2023 | February 12, 2024 | N/A | N/A |
Overall Usefulness of Internal Audits
Based on the post-audit survey results received, senior management agreed that overall the audits conducted were useful.