G.4 Standards and Quality Control Applied to Report Development

  1. This policy sets out Practice Review and Internal Audit’s (PRIA) philosophy and practices aimed at ensuring high-quality reports.

Emerging Audit Items

  1. The discussion of emerging items with various levels of employees and management begins immediately when the item comes to light. Potential areas of improvement are discussed with all parties involved, both doers and decision makers, in operational, financial, and systems-related areas. This is done in the course of developing the item, as part of our quality control process, and ensures appropriate employee and management input to the evaluation of the item and the proposed solution.

Summary Discussions with Management

  1. When the above process is complete, all items are verbally reported to and discussed with senior management. This comprehensive documented reporting is important to again confirm the quality of observed facts, obtain further management input to the recommended improvement, and facilitate timely management action. It further enhances the sustainability of the ultimate improvement solution.

PRIA Report—Pending Management Response

  1. The above items, and only those items, are then considered for inclusion in the written report, at PRIA’s discretion. Items considered for inclusion are subject to a second internal auditor’s input as part of our quality control process, usually by a supervisor or manager.

  2. As a result of this approach, management is fully aware of the observations and generally in support of the recommendations for improvement.

Management Response

  1. It is then management’s responsibility to address the items and to provide for each a management response, setting out intended improvement action and a time line for inclusion in the final report. This may have already been jointly developed and agreed upon with PRIA. Management has the option to

    1. agree with the observation and recommendation, and propose a date for implementation of the improvement action;

    2. agree with the observation, but propose an alternative solution;

    3. agree with the observation, but choose not to act and to accept the related risk, stating reasons; or

    4. disagree with the observation stating reasons. As a result of our quality control process and detailed discussions with all levels of management, this should be a rare occurrence.

  2. All responses must be kept to a maximum of 200 words, and should include actions that the area under audit intends to take to respond to the recommendation. A detailed action plan will be included separately with timelines and a description of what will be completed.

  3. PRIA will work actively with management in supporting and advising them on the formulation of their responses to ensure they fully address the recommendation, indicate adequate and timely improvement action, and take credit for actions already in place.

  4. Internal auditing has the option to include Additional Internal Audit Comment on an item at this stage, but it is intended that this would be seldom used.

  5. As a result of this process, any differences of opinion or contentious items that exist at this point, in either the observation or the action required, are clearly discussed and evidenced showing the reasons and documenting any risk assumed by management.

Considerations of Risk

  1. A key responsibility of PRIA is to bring risks to the attention of management so they can evaluate whether to accept the risk or take action to reduce it. PRIA should not take responsibility for negotiating the acceptance of risk or setting risk tolerances. Therefore, if management chooses to accept a different level of risk than that suggested by an internal audit recommendation, the difference is evidenced by management’s response and, therefore, brought to the attention of senior management and the Audit Committee.

  2. Similarly, the presentation of any contentious items and related risks assumed is automatically seen by senior management and the Audit Committee. If an item is improved or an issue is clarified as a result of the reporting process, this is also evidenced in the report.

Considerations of Accountability

  1. PRIA’s approach to reporting contributes accountability and positive incentives to the process:

    1. Most importantly, it holds PRIA accountable for the quality and accuracy of observations presented. If management disagrees with an observation, it is evidenced in the report with reasons.

    2. It provides incentive to management to work actively with PRIA during the audit, thereby ensuring accurate and meaningful items are brought to the report. If a thorough discussion is left until items appear in the report, management’s input becomes less timely or effective. Differences not discovered until this stage are expensive and disruptive to resolve because they involve additional time and expense and delay the reporting process, and thus may delay the improvement of other items.

    3. It provides an incentive to adequately address sensitive items for timely improvement action. It contributes to the effectiveness of internal audit reports by ensuring a frank presentation of issues and the obligation to address them.

Last modified:
2018-03-07