Quality Assurance Reviews: A Client’s Perspective

The Chief Audit Executive at Crane Credit Union in Indiana, Tom Cosby, was one of the earliest adopters to The Audit Library subscription service. He has been an advocate for our business and the Internal Audit industry as a whole for quite some time. If you are a member of the Association of Credit Union Internal Auditors (ACUIA), you have probably run into Tom at conferences and have certainly benefited from his many volunteer roles, which include serving as a Board Member.

In early 2020, Tom engaged The Audit Library to perform a Quality Assurance Review for the Internal Audit Activity at Crane Credit Union, with John Kaneklides performing as the lead.  Olivia Whipple recently interviewed Tom so other auditors could learn about this process from his perspective.

Olivia Whipple: Tom, thank you so much for letting me pick your brain about the recent engagement we worked on together. What prompted you to complete a request for proposal for your Quality Assurance Review earlier this year?  

Tom Cosby: Our department had been in existence for eight years. I wanted to see where we stood on compliance with IIA Standards and find out where we could make improvements in the Internal Audit operation. 

OW: Tell our readers a bit about your Credit Union, your Internal Audit department, and your Supervisory Committee

TC: Our credit union is located in Southern Indiana. We have 140 employees and an asset size of $734 Million. We will be closing on two acquisitions in the next five months and our asset size will increase to about $950 Million. I started the Internal Audit department in August 2012. I am the only employee in the Internal Audit department at this time. Our Supervisory Committee has three members and they meet quarterly. I report directly to the Chairman of the Supervisory Committee with a dotted line to the CEO (administrative reporting). 

OW: Wow, starting a department from scratch is one of the hardest challenges for an Internal Auditor. Had Crane Credit Union ever had a Quality Assurance Review prior to you initiating this project in 2020? 

TC: Crane never had a Quality Assurance Review prior to this year. 

OW: That’s very common for many of the Credit Unions we work with. What were you hoping to achieve by engaging a Quality Assurance Review? 

TC: I wanted to see where the Internal Department could improve, as far as complying with IIA Standards, and how we could improve the operation of the department when it comes to performing audits. I also wanted to see if we were meeting management’s expectations of what they wanted from Internal Audit. 

OW:  Your goals for this QAR were very admirable. A lot of the time, we work with Credit Unions where nothing is necessarily “wrong,” but Chief Audit Executives such as yourself want to raise the bar and get an outsider’s perspective on department operations and processes. What is an example of something that was changed or implemented at Crane Credit Union’s Internal Audit department, specifically because of the Quality Assurance Review? 

TC: We revised our Internal Audit Charter, Supervisory Committee Charter, Internal Audit Policy, and Internal Audit Procedures as a result of this review. We also came up with an audit plan for the next three years that was realistic to achieve with the time and audit resources available. 

OW: That’s great! But I’m sure not everything was easy or straightforward. Quality Assurance Reviews do require some time and effort on the part of the staff involved. What is an example of something that was difficult in this process? For example, were there any major disagreements with the engagement team, differences of opinion or interpretation of the Standards, etc. 

TC: There were no major disagreements with the engagement team including the interpretation of the Standards. We have now implemented most of the recommendations. Having not gone through this process before, I was a little concerned as to what to expect from the review. 

OW: I’m glad there were no disagreements; that can happen sometimes. As you know, all of our engagements are being performed remotely for the duration of the COVID-19 pandemic. All of our peers are similarly working remotely, and this has presented some challenges in our industry. How was the process of having a remote Quality Assurance Review for you? Were you able to transfer engagement requested items, have meetings, review report drafts, etc. to your satisfaction? 

TC: The remote Quality Assurance Review worked very well for me. There were no issues transferring documents or with anything else. All of our outsourced audit engagements in 2020 have been remote, so I was able to adjust easily to the remote process. I think the remote option is good to have as an alternative to the in-person option. 

OW: Working remotely in 2020 has certainly opened our eyes to the possibilities going forward. While we look forward to getting out and about, I’m sure remote work is here to stay in some form. What was Credit Union management, the Board, and the Supervisory Committee’s reaction to the results of the QAR?

TC: The entire Supervisory Committee responded and were very impressed with the QAR. In a few weeks they will be approving some changes that were a result of the QAR recommendations. I have not received any reaction from the Board and Management.

OW: Well I can speak to that. The officials and executives we worked with over the course of the QAR were very complimentary of you, and happy to assist John. It’s a pleasure to work with a Credit Union team that values Internal Audit! Did you receive any additional resources or acknowledgement due to the QAR?

TC: Other than the Supervisory Committee, our state examiners were glad to see I had the QAR and have requested a copy of the report to review as part of the first quarter assessment they will be performing. There are no additional audit resources (personnel) budgeted for 2021. This will be a discussion item this month between myself and the Supervisory Committee Chairman. Hopefully we will be able to include that in the 2022 budget either as additional personnel and/or outsourcing some more audit work. 

OW: These big initiatives do take some time, and we are happy to see Crane moving in this direction! Tom, you are a leader among auditors in the Credit Union industry. What advice would you give audit leaders like yourself, who are currently planning for 2021 and considering a Quality Assurance Review engagement? 

TC: If you have not had a Quality Assurance Review before, I would encourage audit departments to have one in 2021 and to budget for one every five years after that. I would also encourage audit leaders to conduct the self-assessment each year between the external assessments. I found the first self- assessment I performed last year, prior to the Quality Assurance Review, to be very helpful to me. 

OW: Tom, thank you again for engaging The Audit Library to perform your Quality Assurance Review. It is always a pleasure to work with you. Best to you, and everyone at Crane Credit Union!

If you represent a Credit Union audit department considering a Quality Assurance Review in 2021 or beyond, please contact us for more information or submit a Request for Proposal to get started. Here are links to templates for some of the documents Tom described in his interview:

If you are a subscriber to The Audit Library, these documents will download automatically if you are logged in. If you are not yet a subscriber, the links will take you to our checkout page where you can browse options and determine which plan is best for you. Our plans start at just $399, and can save auditors a lot of time and effort. We can also help you get your house in order if a Quality Assurance Review is around the corner.

Thank you for reading! Please leave a comment with any questions or comments. You might even hear from Tom, who is a prolific commenter on this blog! This will be our last post of 2020. We wish all of our subscribers, consulting clients, and readers a happy and healthy 2021! 

Share on facebook
Share on twitter
Share on linkedin

Leave a Reply

Your email address will not be published. Required fields are marked *