The black box of internal auditing in Canada’s public sector
Simultaneously watchdogs and advisors, internal auditors typically perform two separate but inter-related functions within organizations. In their assurance capacity, they evaluate and document the effectiveness of processes associated with risk management, governance, and control (an example of a control process would be the division of the steps of procurement among employees to minimize the risk of impropriety in the purchase function). Then, they draw on the breadth of their organizational understanding to advise top managers about areas they should target for improvement, streamlining, or growth.
Clear escalation and reporting mechanisms, coupled with abundant research in the area, help to clarify how internal auditing works within the private sector. Its operation within the public sector, on the other hand, is still an enigma—one that Ouafa Sakka (Associate Professor, Accounting) has been trying to unlock with the support of a SSHRC Insight Development Grant.
Published research in the general area is scarce, and there is limited knowledge about the structure of public sector internal auditing in Canada, which is comprised of two units: (i) the internal auditors (IAs) and Chief Audit Executives (CAEs), and (ii) the Audit Committee. Consequently, when Ouafa embarked on this project, “we didn’t know much about what internal auditors were doing in the public sector, and didn’t know anything about what Audit Committees were doing or what exact roles they were playing.”
Informed by an extensive literature and public policy review, and the qualitative interviews she has conducted, Ouafa has identified a number of factors that challenge the quality of the internal audit function in the Canadian federal sector. Ironically, some of these stem from mechanisms designed to ensure transparency.
“Because internal auditor reports are public, auditors are very careful about what they say—so much so that the reports don’t ultimately provide a lot of information.” The delays associated with ensuring that the reports are available in both English and French, and that they are accessible to people with diverse needs, also limit the urgency and impact of the reports, as management is unlikely to wait out the six or seven months between audit completion and report release before acting on identified problems.
The second challenge is the way the internal audit function is structured in the public sector. In the private sector, internal auditors report to the Audit Committee, which is part of the Board of Directors, the highest governance and oversight mechanism in the organization. Reporting to the Audit Committee thus gives internal auditors the possibility to be independent from Senior Management.
Although public sector internal auditors also report to an Audit Committee, that Audit Committee is there to assist Deputy Ministers in achieving their goals and cannot be considered as a governance mechanism. As a consequence, “Internal auditors cannot really play their watchdog role in the public sector. The way they are structured makes them almost exclusively advisors. They are there to help the Deputy Minister; that’s it.”.
The final factor Ouafa has identified is the high level of turnover among IAs and CAEs. Because their work requires them to acquire a general understanding of how an entire department works, CAEs often use the position as a launchpad to senior management positions, and IAs don’t necessarily stay within a department much longer. “There is a lot of movement of internal auditors from department to department, which prevents them from doing their job as well as they could.”
As she moves into the next stage of the project, Ouafa will carefully sift through transcripts of her interviews with public sector IAs, CAEs, and Audit Committee members, to determine whether additional data collection will be necessary and what kinds of solutions might be possible.
“The situation is complex, so it’s not easy to make recommendations, but I’ve started asking, what can we do differently? Are we satisfied with the current internal audit role or is there willingness to make changes? What would those changes look like?”
UItimately, Ouafa aims to share her final results with fellow researchers, the general public, and professional and regulatory organizations. In particular, she anticipates recommending changes to the Institute of Internal Auditors to reflect the profound differences in how internal auditing functions within the public and private sectors. She is also planning to make her findings accessible to the general public, who would benefit from a better understanding of what IAs are – and are not – able to do within the context of our federal government.
