Section: Volume B

The first step for a newly hired chief audit executive (CAE) to build and maintain the proficiency of the internal audit activity should be to incorporate the basic criteria of internal audit competency into job descriptions. This foundational step ensures that all current and future hires are aligned with the required skills and competencies needed for effective internal audit functions. It sets a clear expectation of skills and knowledge right from the recruitment stage, thereby facilitating the development and maintenance of a competent audit team.References: The Institute of Internal Auditors (IIA) - Practice Guides on Talent Management

If the recommendations made by the internal audit activity regarding the organization ' s risk management function remain unaddressed, the next step should be for the chief audit executive (CAE) to discuss this matter with senior management and the board. This discussion aims to ensure that senior leaders are aware of the unaddressed risks and can take necessary actions to address the internal audit ' s findings effectively.
The IIA ' s International Standards for the Professional Practice of Internal Auditing, which stipulate the CAE
' s responsibilities in communicating significant risk exposures and control issues to senior management and the board.

In situations where proper segregation of duties is not achievable due to insufficient staffing, internal auditors recommend the implementation of compensating controls. Compensating controls are additional procedures or safeguards designed to reduce the risk associated with insufficient segregation of duties. These controls do not prevent errors or fraud from occurring but aim to detect them in a timely manner if they do occur.
For instance, in a small manufacturer where the accounting department cannot separate tasks adequately due to limited staff, the auditor might suggest:
* Enhanced supervisory reviews: Managers or supervisors closely review and approve transactions and reconciliations performed by the staff.
* Periodic independent reviews: Regular audits or reviews by internal auditors or third-party auditors to ensure transactions are proper and in compliance with company policies.
* Use of technology: Implementing automated controls that require multiple approvals for significant transactions.
* Rotation of duties: Regularly rotating employees' responsibilities to prevent familiarity and collusion.
These measures help mitigate the risks that arise from the lack of segregation of duties, providing reasonable assurance that financial records are accurate and that fraud or errors are detected promptly.
The Institute of Internal Auditors (IIA) Standards and Practice Advisories.
COSO Internal Control - Integrated Framework.
"Internal Auditing: Assurance & Advisory Services" by IIA, Chapter on Control Activities and Segregation of Duties.