External Assessment of the. Internal Audit Activity. Date: October, 24 th and 25 th Juan José Jiménez Alonso Lead Auditor SGS ICS España

Transcription

1 OFFICE FOR HARMONIZATION IN THE INTERNAL MARKET (Trade Marks and Design) External Assessment of the Internal Audit Activity Date: October, 24 th and 25 th 2012 Juan José Jiménez Alonso Lead Auditor SGS ICS España

2 REPORT INDEX 1. AUDIT OBJECTIVES 2. AUDIT SCOPE 3. AUDIT PROGRAMME 4. EXTERNAL AUDIT TEAM 5. OHIM S PERSONNEL INTERVIEWED 6. REFERENCE DOCUMENTATION 7. AUDIT DEVELOPMENT 8. AUDIT SUMMARY 9. FINDINGS AND RECOMMENDATIONS 10. CONFORMS WITH THE EXTERNAL ASSESSMENT 11. CONFIDENCIALITY 12. DISTRIBUTION LIST 13. ANNEXES Page 2 of 17

3 1 AUDIT OBJECTIVES The objective of this external assessment is to conduct a validation of the internal self-assessments and the internal audit activity. The elements of the internal audit (IA) activity considered were: Conformity to the International Standards and the OHIM charter. Conformity to the expectations expressed by the Office s President, senior management and operational managers. Integration of the IA activity into the organization s governance process. Determination of whether IA activity adds value to the organization. The external assessment team conducted a process-based audit focusing on significant aspects and objectives required by the Standards, since the assessment is a requirement stated in the International Standard 1312 and Practice Advisory Standard : External assessments must be conducted at least once every five years by a qualified, independent reviewer or review team from outside the organization. This Standard was issued by the Institute of Internal Auditors. 2 AUDIT SCOPE The audit was performed in October 24th and 25th 2012 and the scope was the activity developed by the Internal Audit Service of the OHIM against the framework set up by The Standards on Attributes and Performance for the Internal Audit Activity issued by the Institute of Internal Auditors; The Internal Audit s Charter of the OHIM; The Internal Control Standards and Underlying Framework issued by Commission of The European Communities; Page 3 of 17

4 3 AUDIT PROGRAMME The audit program is showed in the Annex II. 4 EXTERNAL AUDIT TEAM The external audit team who performed the assessment was: Lead Auditor: Juan José Jiménez Alonso (SGS) Auditor: Reyes Salinas González (SGS) The individuals of the team who performed this external assessment are free from any obligation to, or interest in, the OHIM internal audit activity or the personnel of the Office. The external review team is independent in the way the Practice Advisory Independence of the External Assessment Team in the Public Sector states. This Practice Advisory Standard was issued by the Institute of Internal Auditors. 5 OHIM S PERSONNEL INTERVIEWS Names and positions are showed in Annex I. 6 REFERENCE DOCUMENTATION The Attribute and Performance Standards issued by the Institute of Internal Auditors rv2010. The Internal Audit s Charter of the OHIM (v.2.1) The Internal Control Standards and Underlying Framework issued by Commission of The European Communities Page 4 of 17

5 7 AUDIT DEVELOPMENT The audit was carried out according to the procedures stated in the Practice Advisory Standards and issued by the Institute of Internal Auditors. The findings showed in this report have been inferred from a sample of documents, records and interviews. The sample was based on a number of Office s personnel interviewed (managers and operational managers) and the engagements performed by the Internal Audit Service in 2011 and The audit methods used were interviews, observation of activities and review of documentation and records. The structure of the audit was in accordance with the audit program. During the audit, neither reservations were raised nor programmed areas were uncovered. The external assessment objectives were accomplished. All the Office personnel participating was very cooperative during the assessment. 8 AUDIT SUMMARY Attribute Standards Purpose, Authority, and Responsibility The purpose, authority, and responsibility of the internal audit activity is formally defined in the OHIM internal audit charter, consistent with the Professional Practice of Internal Audit, COSO and the Internal Control Standards issued by Commission of The European Communities. The head of the Internal Audit Service periodically reviews the IA charter (version 2.1) and present it to Office s President for approval. Independence and Objectivity The internal audit activity is independent from an organizational and functional point of view, with direct access to the senior management and the Office s President. Individual internal auditors deal with objectivity in performing their work, and in compliance with the professional Standards and Code of Ethics (they do not participate in any activity that may, or be presumed, to impair their unbiased assessment). No formal complaint was evidenced on this requirement. Page 5 of 17

6 If independence or objectivity is impaired in fact or appearance, the Office s Code of Good Administrative Behavior is expected to be operated in order to determine appropriate parties and the process to be followed. Internal auditors do not assess specific operations for which they were previously responsible within the previous years. There was no evidence that internal auditors were engaged in consulting services in the Office. Proficiency Internal auditors possess the knowledge, skills, and competencies needed to perform their individual responsibilities. As a whole, the IA activity collectively possesses the knowledge, skills, and other competencies needed to perform its responsibilities. When additional expertise has been needed, reviewers or experts have been hired. This is the case of a HACCP audit on the catering services. Internal auditors have the professional proficiency required. Appropriate certifications and professional experience are demanded in the profile job when they are hired. The Office supports education in issues related to their continuing professional development. Internal auditors have different profiles and they are performing both specialized and cross functional assessments. Annual Activity Report 2011 and Audit Plan 2012 state more than 25 engagements each year, audit engagements performed were focused in a very wide range of activities: facility management, OHIM operational issues, ISO schemes (9001, 27001), teleworking, and others. Quality Assurance and Improvement Program The head of the Internal Audit Service is developing and maintaining a quality assurance and improvement program that covers all aspects of the internal audit activity. This program allows an evaluation of the IA activity s conformance according to the professional Standards and Charter. The quality assurance and improvement program includes both internal and external assessments. Periodic reviews are performed through self-assessment or by other persons (Quality Officers) within the organization with sufficient knowledge of IA audit practices. Page 6 of 17

7 An external assessment has been conducted at least once every five years by a qualified, independent reviewer or review team from outside the organization. As it is established currently, the internal audit activity was established in 2007 and this report is the first from an external assessment team. The head of the Internal Audit Service periodically communicates in the Office s Committees the results of the quality assurance and improvement program to the senior management and the disclosure of nonconformance. He has periodical meetings with the Office s President and Cabinet Director. The results of the quality assurance and improvement program include the results of both internal and external assessments. Performance Standards Managing the Internal Audit Activity The head of the Internal Audit Service is effectively managing the internal audit activity at the Office since report findings and recommendations add value to the organization. We evidenced that the IA activity is effectively managed in terms of results achieved the purpose and responsibility included in the IA Charter, the activity also conforms with the Standards and the individuals who are part of the IA activity demonstrate conformance with the requirements in the Standards. The IA activity provides objective and relevant assurance, and contributes to the effectiveness and efficiency of governance, risk management, and control processes. Annual Audit Plans are previously agreed with senior management and, when the year goes by, new needs are considered as entries in the Annual Plan. Planning Plans are based on priorities for the internal audit activity, and they are consistent with the organization s goals. The head of the Internal Audit Service identifies and considers the expectations of the Office s President, senior management, and other stakeholders for IA opinions and other conclusions. He is accepting proposed engagements based on the engagement s potential to improve the organization s operations. Accepted engagements are included in the Annual Plan. He also communicates the IA activity s plans and resource requirements to the Office s President and senior management for review and approval. Page 7 of 17

8 Resource Management The head of the Internal Audit Service ensures that resources are appropriate, sufficient, and effectively deployed to accomplish the approved plan. He also coordinates activities with other internal and external providers of assurance and consulting services to ensure proper coverage and minimize duplication of efforts. Policies and Procedures Internal audit policies and procedures have the form and content to guide the IA activity. Reporting to Senior Management Reporting is periodically performed to Office s President and senior management on the internal audit activity s purpose, authority, responsibility, and performance relative to its plan. The Head of the Service periodically meets with the President and he is also member of the two managerial committees at the organization. Nature of Work The Internal Audit Service is evaluating how their work is contributing to the improvement of governance, risk management, and control processes using a systematic and disciplined approach. Governance The IA activity offers recommendations for improving the governance process since the Service focuses on ensuring effective organizational performance management and accountability, communicating risk and control information to other areas of the Office. Information provided is related to financial and operational issues, effectiveness and efficiency of operations and programs, safeguarding of assets, and compliance with laws, regulations, policies, procedures, and contracts. Control The IA activity is assisting the organization in maintaining effective controls by evaluating their effectiveness and by promoting continuous improvement. Engagement Planning Internal auditors develop and document a plan for each engagement, with the engagement s objectives, scope, timing, and resource allocations. They also consider planning consideration in terms of controls, risk, and opportunities to improve control processes. Page 8 of 17

9 Engagement Objectives and Scope Objectives and scope are established for each engagement. Internal auditors consider the probability of significant errors, fraud, noncompliance, and other exposures when developing the engagement objectives. The established scopes satisfy the objectives of the engagement since systems, records, personnel, and physical properties, including those under the control of third parties, are considered. Engagement Resource Allocation International Standards for the Professional Practice of Internal Auditing (Standards) Internal auditors are determining resources to achieve engagement objectives based on an evaluation of the nature and complexity of each engagement, time constraints, and available resources. According with the results, they develop and document work programs that achieve the engagement objectives. The Service programs include the procedures for identifying, analyzing, evaluating, and documenting information during the engagement. Performing the Engagement Internal auditors identify, analyze, evaluate, and document sufficient information to achieve the engagement s objectives. Internal auditors identify sufficient, reliable, relevant, and useful information to achieve the engagement s objectives by developing the use of appropriate techniques. Relevant information is based on analysis and evaluations, and supports engagement observations and recommendations and is consistent with the objectives for the engagement. Documenting Information Internal auditors document relevant information to support the conclusions and engagement results. The Service stores the engagement records and controls the access to them. A procedure on record, custody, classification and retention of the information was evidenced. The head of the Service obtains the approval of Office s President prior to releasing such records to internal or external parties, as appropriate. An example is the audit on facility safety. Page 9 of 17

10 Engagement Supervision and Communication of Results Engagements are supervised to ensure objectives are achieved, quality is assured, and staff is developed. Appropriate evidence of supervision is documented and retained. Internal auditors communicate the results of engagements, including objectives and scope as well as applicable conclusions, recommendations, and action plans. Main conclusions are communicated to President of the Office and senior management in the appropriate Committees, and engagement reports are published in the Office s intranet when appropriate. When releasing engagement results to parties outside the organization, the communication includes limitations on distribution and use of the results. A procedure is on place. Engagement Disclosure of Nonconformance When nonconformance with the Standards or audit frameworks impacts a specific engagement, the Service communicate the results, discloses the reason(s) for nonconformance, and the impact of nonconformance on the engagement and the communicated engagement results. Disseminating Results The head of Internal Audit Service communicates results to the appropriate parties and controls the timing to publish the report in the Office s intranet. He reviews and approves the final engagement communication before issuance and decides to whom and how it will be disseminated. Overall Opinions When an overall opinion is issued, it takes into account the expectations of the Office s President, senior management, and other stakeholders and it is supported by sufficient, reliable, relevant, and useful information. The reasons for an unfavorable overall opinion are also stated. Monitoring Progress The Internal Audit Service has established and maintained a system to monitor the disposition of results communicated to management. This system is based on a follow-up process to monitor and ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action or delay the implementation of control measures. Page 10 of 17

11 9 FINDINGS AND IMPROVEMENTS The audit team concludes that the Internal Audit Service of the Office for Harmonization in the Internal Market manages their professional responsibilities in line with the requirements of the professional Standards and demonstrates the ability to systematically achieve agreed requirements for engagements within the scope and the Office s policy and objectives. Nonconformities The reviewer team has not found any nonconformity against the professional Standards and internal audit frameworks that we referenced in the Part 2 Audit Scope of this report. The Internal Audit Service accomplishes the attribute and performance requirements defined in the Institute of Internal Auditors. Opportunities for Improvement During the external assessment, the following opportunities for improvement were detected: The Internal Audit Service is working with risk-based engagements in the cooperation programmes/projects and in the Information Security areas. The Head of the Service is using his own judgment of risks after consultation with senior management in engagements conducted in other areas. We propose to take into consideration to working with a risk based orientation in other management areas and when the engagement plans are defined, this implies to take into account an organization s risk management framework, including using risk appetite levels set by management for the different activities or parts of the organization. An audit oriented to risk will facilitate the decision making on defining priorities and planning. The Internal Audit Service is improving the monitorization of the efficiency and effectiveness of their activity. Ongoing monitoring is an integral part of the day-to-day supervision, review, and measurement of the internal audit activity. We propose, especially, to devote some time to develop the indicators to measure the efficiency and effectiveness of the controls implemented in the action plans, since the Service is not performing additional audits to the implemented controls. We think that this will establish a follow-up process to Page 11 of 17

12 monitor and ensure that management actions have been effectively implemented. The Service also needs to implement the metrics and indicators of their own work in order to improve the managerial overview of their activity. The Service is using in its bimonthly status report on action plans the follow-up category of partial status. We propose to introduce the degree or stage of completion of the actions in order to add information on how the implementation of controls is progressing and to improve the follow-up process. The Operations Support Director of the OHIM has appointed an Internal Audit Coordinator. This role has been considered as very useful for both Operations personnel and Internal Auditors in order to coordinate the engagements. The role is very similar to the one developed by the Quality Officers but, in this case, the coordination is for all the different engagements performed in the business area. We propose to study the benefits and feasibility to extend this practice by appointing IA Coordinators in other areas of the Office. This best practice may improve not only the coordination between services but also improve understanding of the business needs and the audit process, and therefore to reduce time or resources to be devoted to the engagements. The Human Resources Area is in charge of evaluating the effectiveness of the training actions. The Internal Audit Service has not a direct feedback on the degree of effectiveness of the Internal Auditors training actions taken. We propose the Internal Audit Service gets feedback of this effectiveness from the Human Resources Area or by implementing their own training indicator. Strengths Internal Audit Service in the OHIM has the following strengths in the development of their activity and the achieving of the Service objectives: The senior management commitment with the internal audit function and the participation of the Head of the Service in the different managerial and operational committees. Page 12 of 17

13 The professional experience and the adequate qualification of the internal auditors in the performance of engagements. The focus of the whole audit team to add value and support to the organization when audit findings and recommendations are issued. 10 CONFORMS WITH THE EXTERNAL ASSESSMENT The Internal Audit Service is in agreement with the findings set forth in this report. 11 CONFIDENCIALITY All staff of SGS, and in particular its auditors, have established the confidentiality agreements on all the information they have access to in the development of their activities. The audit team members have obligations regarding compliance with auditor s Code of Ethics and professional Standards in this area. 12 DISTRIBUTION LIST This report has been distributed to the following persons: Mr. Javier RUJAS Mr. Guillermo FORNER Head of the Internal Audit Service at the OHIM. Manager of Professional Services at everis. 13 ANNEX I. Staff Interviewed II. Audit Program Page 13 of 17

14 ANNEX I: OHIM S STAFF INTERVIEWED Name JAVIER RUJAS MORA-REY JUSTYNA ANTOLAK-SZYMANSKA ANBELLE DANJEAN ÓSCAR AUSÍN MARTÍNEZ CLAIRE DURANTON CRISTÓBAL LANDER MARTINA SCHNEIDER ALEXANDRA APOSTOLAKIS SUSANA PÉREZ FERRERAS CARMEN CAVADA IPIÑA TIMEA HOLIK CAYETANA BORREGO CABEZAS MIGUEL ÁNGEL VILLARROYA SANCHEZ Position Internal Auditor, Head of the Internal Audit Service Auditor, Internal Audit Service Auditor, Internal Audit Service Auditor, Internal Audit Service Quality Manager, Quality Management Service Business Information Technology Area, Infrastructure Department Head of User Contact Service, Operations Support Department Head of Register and Fees Service, Operations Support Department Director of the President s Cabinet Quality Officer, Operations Department Head of Vendor Management and Support Service, Infrastructure Department Head of Development and Recognition Service, Resources Department Deputy Director of Infrastructure and Buildings Area, Infrastructure Department Page 14 of 17

15 ANNEX II: AUDIT PROGRAMME Plan de Auditoria / Audit Plan Organización / Organization: Dirección / Address: Número de Visita / Visit Number: Auditoría Realizada a / Visit Due by Date: Lead Auditor: Miembros del equipo / Team Member(s): Estándar (es) / Standard(s): Idioma de la Auditoría / Audit Language: Alcance de la Auditoría / Audit Scope: Oficina de Armonización del Mercado Interior. Marcas, Dibujos y Modelos. OAMI Avenida de Europa Alicante España NA Fecha de la Auditoría / Actual Visit Date: NA Juan José Jiménez (JJJ) Reyes Salinas González (RSG) Estándar Internacional 1312, PA , y 25 de octubre de 2012 Para información del Auditor / For auditor information only Normas de Evaluación Externa emitidas por The Institute of Internal Auditors Inglés / Español La Actividad de Auditoria Interna (AI) de la OAMI Objetivos de la Auditoría: Confirmar que el sistema de gestión ha sido establecido e implantado de acuerdo con los requisitos establecidos por el estándar de auditoría. Page 15 of 17

16 / Date Hora / Time :30 Auditor Area / Departamento / Proceso / Función Area / Department / Process / Function Reunión de Apertura de Auditoría Persona de Contacto / Key Contact 10:00 La OAMI: Organización y Actividades 10:30 La Actividad de AI: Objetivos, Relaciones e Integración en la OAMI. 11:00 La Actividad de AI: Estándares, Charter, Planes, Políticas, Procedimientos y Requisitos Regulatorios 12:30 La Gestión de la AI 14:00 Comida 15:00 RSG Auditorías asociadas a la Gestión de la Calidad 15:00 JJJ Auditorías asociadas a la Seguridad de la Información 17:45 Reunión de Cierre del Primer Día de Auditoría 18:00 Fin del primer día :30 Reuniones con Directores y Responsables de Servicio. 11:00 RSG Auditorías asociadas a la Gestión de RRHH 11:00 JJJ Auditorías asociadas a la Gestión de Tecnologías de la Información y las Comunicaciones/ Infraestructura 14:00 Comida 15:00 RSG Auditorías asociadas a la Provisión de Recursos 15:00 JJJ Auditorías asociadas al Cumplimiento Normativo 17:00 Reunión de Equipo Auditor Page 16 of 17

17 / Date Hora / Time 17:30 Auditor Area / Departamento / Proceso / Función Area / Department / Process / Function Reunión de Cierre de Auditoría Persona de Contacto / Key Contact 18:00 Finalización de la Auditoría Notas para el Cliente: Los tiempos son aproximados y serán confirmados en la sesión de apertura antes del inicio de la auditoría. Los auditores de SGS se reservan el derecho a modificar los elementos enumerados, antes o durante la auditoría, en función de los resultados de la revisión efectuada en la organización. La utilización para uso de los auditores de un lugar privado para la preparación, revisión y reuniones sería aconsejable. El tiempo destinado para la comida no debería soprepasar la hora indicada en este plan. Su contrato con SGS es una parte integral de este plan de auditoría y los detalles de los acuerdos de confidencialidad, alcance de la auditoría, la información sobre las actividades de seguimiento y cualquier requisito especial Notes to Client: Times are approximate and will be confirmed at the opening meeting prior to commencement of the audit. SGS auditors reserve the right to change or add to the elements listed before or during the audit depending on the results of on-site investigation. A private place for preparation, review and conferencing is requested for the auditor s use. Please provide a light working lunch on-site each audit day. Your contract with SGS is an integral part of this audit plan and details confidentiality arrangements, audit scope, information on follow up activities and any special reporting requirements. END OF REPORT Page 17 of 17