control, and governance
A version of this article previously was published in IIA-Australia Journal.
The ABCs of Adding Value
A seasoned CAE outlines simple steps for internal audit to sharpen its focus, enhance its contribution, and satisfy stakeholder needs.
Throughout my many years as a chief audit executive (CAE), partnering with audit committees and auditors to transform audit departments that were not living up to expectations, I’ve implemented successful strategies that have changed stakeholder perceptions. In one struggling internal audit function, the audit committee’s average satisfaction rating with internal audit sat at 55 percent. The audit committee and senior management did not perceive that they were getting value from their investment in the function. When I came aboard as the CAE, I articulated the vision, and then established strategies to sharpen the team’s focus and direction, enhance its contribution, and satisfy the needs of the audit committee and other stakeholders. After three years, the audit function was widely regarded as high performing and seen as mature. Its overall approach, processes, and reporting were representative of world class. And the audit committee’s average satisfaction rating had risen to 95 percent.
The essence of the transformation to delivering value to the audit committee was as simple as A, B, C — being attuned, balanced, and credible (see "Top Ten Practice Tips for Each Element"). The tips, tools, and concepts can be championed by an audit committee chair or member, the CAE, a senior audit leader, or a new audit practitioner.
The relationship between the audit committee and internal auditors is symbiotic. Internal auditors typically are a primary source of objective assurance and advice. It is essential that internal auditors understand what their audit committee and other stakeholders need, and consistently meet their expectations.
The responsibilities of audit committees have grown in recent years, and their expectations of internal auditors in supporting them have similarly increased. The success of each is mutually dependent. Another important component is the support of senior management and its genuine commitment to introducing and maintaining effective governance arrangements.
The information available both within an entity and externally provides a rich harvest for internal auditors to tune in and shape their own work plans and activities. Notably:
Internal auditors are expected to be attuned with what’s really going on in the business, and what’s coming over the horizon. The introduction of innovative concepts such as knowledge champions help provide expertise across a range of business and technical areas.
There will be an increasing need to consider the entity’s culture to determine whether it is in sync at all levels. An assessment of soft controls can provide insights on how the business is running.
Internal auditors already should be involved in activities beyond the traditional compliance and accounting areas of internal audit coverage. As a source of advice, they are positioned to contribute to the enhancement of business processes and business outcomes.
At its most basic foundation level, an internal audit activity will have in place a forward work program reflecting its audit work plan for the ensuing one to three years. The internal audit activity will continue to evolve by introducing more mature practices, such as a well-considered stakeholder relationship program that helps to achieve a better alignment with the needs and expectations of key stakeholders, or a knowledge champion program that forms part of the internal audit professional development initiatives by helping build in-house expertise (see “Tools and Concepts for Being Attuned” below). Ideally, internal audit will have all three programs, but the forward work program is important to remaining attuned, balanced, and credible.
Auditors need the right skills to provide a balanced perspective. In addition to business acumen, they need to be able to think strategically and package their reports creatively. The establishment of a capability framework helps shape the profile of auditors for the future.
Setting the right forward work program is vital to achieving a reasonable balance across the entire entity and the high-risk areas. While most audit activities always have had a plan, these days there is a need to sharpen the strategic focus. Increasingly, auditors are expected to discover things that the audit committee and senior management didn’t know. They are well placed to do so as they see across the entire organization.
An internal audit activity that is positioned for success will establish audit themes as a basis for more meaningful, higher-level reporting. As the internal activity drives toward mature practice levels, it will establish a capability framework to address succession planning and talent development, and will introduce an annual report on internal audit to articulate the overall value and contribution to the entity throughout the year (see “Tools and Concepts for Being Balanced” below).
Internal auditors can help audit committees in many different ways. To be balanced, internal auditors can:
The audit team should possess current skills and an appropriate overall capability to deliver the requirements of the internal audit charter and the forward work program. Nothing less than professional excellence will be acceptable to a high-performing audit committee. Professional excellence reflects that the internal audit leaders:
An internal audit activity that is positioned for success will establish its roadmap for delivering upon its vision and mission by clearly articulating its strategic audit plan and complementary professional development plan. The CAE also will recognize the need to provide assurance to the audit committee on internal audit’s compliance with professional audit standards, including quality and improvement standards, through an annual quality assurance assertion. And as the internal activity reaches mature practice levels, it will provide a balanced scorecard report to the audit committee, demonstrating its performance across a range of key performance indicators (see “Tools and Concepts for Credibility” below).
The internal audit function should have sufficient standing within the organization so that the annual report (published in the public domain) contains explicit commentary on internal audit, including its reporting lines, independence, role, level of maturity, and contribution.
Professional outreach strategies will help internal auditors connect with audit leaders and practitioners from outside their organization to avoid becoming too inward looking. The insights gained will help them remain innovative and keep abreast of emerging risks, hot topics, and best practices. The sharing of their organization’s leading edge practices with others is energizing and helps lift their credibility within both the profession and the eyes of internal stakeholders. Moreover, just like any other C-level executive, a CAE’s understanding of the business and contribution to the growth of the organization, and his or her ability to drive awareness of that contribution, meets the expectation of the CAE to play the part of advocate for the profession and the role of internal audit.
An internal audit department can have a significant impact on the organization, regardless of its size. It is as simple as being attuned to the business, adopting a balanced approach, and establishing credibility in the eyes of key stakeholders. This method helps create a professional audit practice whose value and contribution are recognized by stakeholders, and positions it to deliver what the audit committee really needs. Adopting or modifying these concepts can enhance the internal audit function’s reputation with stakeholders and entrust it with more challenging assignments that can provide greater job enrichment and improved career options.
Bruce Turner, CGAP, CRMA, CISA, CFE, has worked as a CAE and in other senior audit roles for more than 30 years. He lives in Sydney, Australia.