F.2 Providing Consulting Services

Practice Review and Internal Audit (PRIA) may provide consulting services to management under specific conditions. For the purpose of this policy, consulting services are advisory in nature and include the provision of advice, counsel, and facilitation or training. The Chief Audit Executive (CAE) would accept to undertake consulting engagement in view of adding value and improving upon the Office’s governance, risk management and control processes.
If significant consulting opportunities arise during an assurance engagement, a specific written understanding as to the objectives, scope, respective responsibilities, and other expectations will be discussed with the internal client, and the results of the consulting engagement communicated in accordance with consulting standards.

Conditions for Providing Consulting Services

PRIA may provide consulting services related to services for which they had previous responsibility or for which they have the knowledge, skills, or other competencies needed to perform all or part of the engagement. If the PRIA team does not have the necessary knowledge, skill or competencies to carry out the consulting engagement, the CAE may obtain competent assistance or decline the consulting engagement.
If internal auditors have real or potential impairments to objectivity and independence related to the proposed consulting service, they must disclose this impairment to the CAE and the internal client prior to accepting the consulting engagement.
The CAE approves all consulting engagement to be undertaken by herself and the team.
The undertaking of consulting engagements reported to the Audit Committee and referenced in PRIA’s multi-year plan.
At no time will the CAE or the PRIA team assume any management responsibility for functional areas for which consulting services are being provided.

In the provision of consulting services, the PRIA team will share information, coordinate activities, and consider relying upon the work of other consulting service providers to ensure proper coverage and minimize duplication of efforts.
In relying on the work of other consulting service providers, the CAE will consider the competency, objectivity, and due professional care of consulting service providers.
The Chief Audit Executive will gain a clear understanding of the scope, objectives, and results of the work performed by other providers of consulting services.
Where reliance is placed on the work of others, the Chief Audit Executive is still accountable and responsible for ensuring adequate support for conclusions and opinions reached by the internal audit activity.

In order to exercise due professional care during a consulting engagement, the PRIA team will consider:
1. the needs and expectations of clients, including the nature, timing, and communication of engagement results;
2. the relative complexity and extent of work needed to achieve the engagement's objectives; and
3. the cost of the consulting engagement in relation to potential benefits.
For significant engagements, consultations with the internal client on the objectives, scope, respective responsibilities, and other client expectations will be documented.
PRIA’s internal auditor will address risk consistent with the consulting engagement’s objectives and be alert for the existence of other significant risks.
Knowledge of risks gained from consulting engagements will be incorporated into PRIA’s evaluation of the Office’s integrated risk management processes, however PRIA does not assume any management responsibility by actually managing risks.
Knowledge of controls gained from consulting engagements will incorporated into PRIA’s evaluation of the Office’s control processes.

The objectives of the consulting engagement must be consistent with the Office’s values, objectives and strategies, and the scope of the consulting engagement must address governance, risk management and control processes to the extent agree upon with the internal client.
In establishing the scope of the engagement, consideration is to be given to the following:
1. The scope needs to be sufficient to achieve the objectives of the engagement.
2. The scope must include consideration of relevant systems, records, personnel, and physical properties, including those under the control of third parties.
3. If internal auditors develop reservations about the scope during the engagement, these reservations must be discussed with the CAE and the internal client to determine whether to continue with the engagement.

An engagement program is to be developed for each consulting engagement and approved by the CAE.
During consulting engagements, internal auditors must address controls consistent with the engagement's objectives and be alert to significant control issues.
Should significant issues related to governance, risk management and controls be identified during the course of the consulting engagement, the CAE will communicate these to senior management and the Audit Committee.
When the Chief Audit Executive concludes that management has accepted a level of risk that may be unacceptable to the organization, the CAE will discuss the matter with senior management. If the CAE determines that the matter has not been resolved, she will must communicate the matter to the Auditor General and the Audit Committee, if need be.
The PRIA team member responsible for the consulting engagement will provide the CAE and the internal client progress reports as determined by both parties.

At the beginning of each consulting engagement, the PRIA team will determine the retention period and custody of documents created during the course of a consulting engagement.
The Office’s records management software, Proxi, will be the repository for these documents and the PRIA team will follow the Office’s policies regarding information management.

The CAE will communicate the results of the consultation engagement to the internal client.

PRIA will monitor the disposition of results from the consulting engagement to the extent agree upon with the internal client.