STATE OF NORTH CAROLINA COUNCIL OF INTERNAL AUDITING OFFICE OF INTERNAL AUDIT PEER REVIEW PROGRAM T21: TESTING TOOL – STAFF PROFICIENCY The purpose of this evaluation is to appraise the recruitment, development, and assignment of the right mix of staff skills to achieve the internal audit activity’s (IA activity’s) mission/goals. When evaluating competencies, the reviewer should refer to the applicable Practice Advisories published by The IIA. Standard Area of Review Indicate any exception Initial/ Date Staffing - Proficiency PA 1. Review the education and background 2020-1 of the IA activity's staff. Internal auditors should possess the knowledge, skills, and other competencies needed to perform their individual responsibilities. The internal audit activity collectively should possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities. PA 2. Review staff and management job 2030-1 descriptions. • Determine whether job descriptions identify career paths for staff. • Determine whether job descriptions provide suitable criteria of education and experience for filling IA positions. • Determine whether current auditors meet the specified criteria of education and experience. PA 3. Obtain and review information 1210-1 pertaining to specialized skills required by the IA activity. • Determine whether the current IA activity staff possesses adequate IT audit skills. • Determine whether any other specialized skills or expertise (i.e. fraud detection skills, consulting skills, etc.) are required to effectively meet unique needs of the agency/university. • If specialized skills are needed, T21-1 Testing ToolStaff Proficiency STATE OF NORTH CAROLINA COUNCIL OF INTERNAL AUDITING OFFICE OF INTERNAL AUDIT PEER REVIEW PROGRAM Standard Area of Review Indicate any exception Initial/ Date determine whether the current staff possesses these skills. • Evaluate whether the qualifications of any consultants used during the review period, and the type of assistance provided, were appropriate. • Conclude as to whether the IA activity possesses or obtains the necessary knowledge, skills, and disciplines needed to carry out its audit responsibilities. 4. Staffing Analysis • Review the current organization chart of the audit activity. Consider the number and levels of the staff PA (both approved and filled). 2030-1 • Determine whether a staffing analysis was prepared by the audit activity as part of the planning PA process. 2030-1 • Determine whether the number and levels of existing staff are in accordance with the staffing PA analysis prepared by the audit 2030-1 activity. • If the size of the audit staff does not permit complete coverage based on the risk assessment, determine that the process used to defer or reschedule audits is reasonable and that the board of directors and/or responsible management officials have been made aware of the effects of the reduced audit coverage of PA high-risk areas. 2020-1 • Conclude as to the adequacy of the number and levels of the internal auditing staff. Continuing Professional Development: Using the criteria from the “Staffing Proficiency” section above, consider the development program as the means to increase the knowledge, understanding, and skills of the staff. (Standard 1230) T21-2 Testing ToolStaff Proficiency STATE OF NORTH CAROLINA COUNCIL OF INTERNAL AUDITING OFFICE OF INTERNAL AUDIT PEER REVIEW PROGRAM Standard Area of Review Indicate any exception Initial/ Date 1. Obtain and review information regarding continuing education. • Determine whether there is a written IA activity policy regarding PA continuing education. 1230-1 • Evaluate IA activity policy as to the required number of hours per year of continuing professional education for each auditor and its PA adequacy. 1230-1 2. Obtain training records and review courses taken by internal auditors during the past 12 months. • Assess the training received and determine whether it represented the necessary courses to maintain proficiency, especially with regard PA to specialized skills. 1230-1 • Determine whether supervisors have received training in PA management skills. 1230-1 3. Assess policy for emphasizing professional certifications (i.e. CIA, CPA, CISA, CMA, CISSP, CBA, etc.), including review courses and examinations. Review reward practices PA and continuing education for those who 1230-1 receive certification. 4. Review the policy and practice for encouraging staff to attend and PA participate in professional associations, 1230-1 such as IIA. 5. Conclude as to the adequacy of the IA activity's continuing education. Performance Appraisals (Standards 1220 - 2340) 1. Review documented performance standards used for evaluations and PA whether they are consistent with the 2340-1 needs of the IA activity. 2. Review policy for at least annual PA performance appraisals and whether 2340-1 evaluations are made of internal T21-3 Testing ToolStaff Proficiency STATE OF NORTH CAROLINA COUNCIL OF INTERNAL AUDITING OFFICE OF INTERNAL AUDIT PEER REVIEW PROGRAM Standard PA 2340-1 Area of Review Indicate any exception Initial/ Date auditors after each audit. Assess how the appraisals are used for measuring and improving performance, career counseling, and development of staff. 3. Assess the potential for, and implementation of, empowerment principles including changes in supervision practices, accountability, self-directed teams, and moving the decision-making and customer relations processes downward in the IA activity. 4. Conclude as to the adequacy of the personnel performance appraisal process. T21-4 Testing ToolStaff Proficiency