Small Audit Functions, Large Audit Abilities
Global Best Practices Jan 31, 2025
10 Tips to Maximize Effectiveness
From the outset, small internal audit functions are at a major disadvantage. Already inherently constrained by resources and budget, teams of often just nine or fewer internal auditors must confront many of the same organizational risks even the largest, most sophisticated audit functions struggle with. And not only that, small functions face the same expectation to conform with The IIA’s Global Internal Audit Standards.
Luckily, however, perception is not always reality. Indeed, around the world, one can find small internal audit functions providing a level of assurance and organizational value that rivals even the highest-performing larger functions. Even just a quick study of these internal audit functions reveals several commonalities that any function, especially peers in terms of size and resources, can learn from.
A Steep Hill to Climb
According to the 2024 North American Pulse of Internal Audit, 17% of all internal audit functions have just one to three full-time employees, and 35% have four to nine employees. Together, this means that over half of all internal audit functions can consider themselves a small audit shop.
The difficult path the smallest internal audit functions must travel is clearly reflected in Pulse, which found:
- Even though 60% of all audit functions use outsourcing or cosourcing to cover assurance gaps (often technology-related, such as cybersecurity or IT), only 32% of the smallest audit functions use sourcing (see Figure 1).
- Only 13% of audit functions with one to three employees recruited for an open existing position in the past year, and only 13% recruited to fill a newly created position (see Figures 2 and 3).
- Thirty-one percent of audit functions with one to three full-time employees either do not consider The IIA’s Three Lines Model, are not sure if they do, or are not aware of the model — a far higher percentage than any other function size surveyed (see Figure 4).
Source: 2024 North American Pulse of Internal Audit.
To some extent, all these issues can be explained by a lack of budget and resources. However, budget and resources should not be a reason for failing to provide maximum organizational value.
Efficiency is a Must
Especially in a small audit function, there is no room for inefficiencies. Indeed, efficiency is a critical part of the new Standards, particularly in Domain IV: Managing the Internal Audit Function. In the planning areas of development, chief audit executives (CAEs) and their staff have no option but to focus on precisely what has been done, what absolutely needs to be done and when it needs to be done, and what resources would be sufficient to get it done. Fortunately, a little creativity can go a long way.
To that end, here are 10 considerations for small internal audit functions looking to match the efficiency of their larger counterparts:
1. Live by the risk-based audit plan.
Nothing shapes the day-to-day of internal audit more than risk, but not all risks are created equal. In planning, it is imperative that a small audit function know which risks demand the most attention. “We all know that, as a small team, you can’t audit everything,” says Amiri Abdallah, director of advisory services at Diamond Consulting Group in Boca Raton, Fla. “A risk-based audit plan is the secret weapon for the small team. Instead of spreading yourself thin, pinpoint the areas where your organization simply can’t afford to fail and focus your audits there. If you’re in retail, maybe it’s inventory fraud. If you’re in tech, it could be data privacy.”
2. Use previous engagement work programs and supporting documentation.
Existing work from auditors, inspectors, consultants, and internal or external experts should never be discounted. Researching and understanding what work has been done and how it might be used requires strong, consistent lines of communication with other departments, as well as vigilant analysis of past records. Relying on data previously compiled and verifiably accurate can not only save engagement time, but also enhance credibility with stakeholders for maximum buy-in.
3. Use in-house talent.
A small team is going to be inherently limited in the expertise it can bring to the table, but it can leverage expertise found in other departments, provided there is no conflict regarding independence and objectivity. The CAE should build relationships with other department heads to help ensure internal audit can aquire the talent it needs for individual engagements, “People will share,” says Joel Kramer, managing director of the internal audit division at the MIS Training Institute in London. Kramer suggests creating “a list of people you were in training with as a new hire and find someone there who could help you.”
4. Don’t be afraid of cosourcing.
Budget will always be a consideration, but where specialized knowledge is necessary, the option to cosource should be considered. In cases where a budget may not support hiring an expert, the CAE should communicate internal audit’s needs regarding possible cosourcing to the board. “Tell them a compelling story,” says Abdallah. “Connect the audit needed to real-world impacts and why it matters to them. Do that, and you’ll get them on board much faster.”
5. Always be networking.
Whether through professional training or a social lunch, auditors who operate in a small audit function should prioritize developing a network of talent that could be leveraged for an audit, a quality assessment, or even simply general advice on establishing benchmarks. According to Kramer, one of the best opportunities he found is becoming active in local IIA chapters, where auditors can interact and compare internal activities, processes, functions, and operations. There is great power in group think.
6. Embrace the right technologies.
Much has been written about the incredible, easy-to-use technology tools introduced to the internal audit profession in recent years — especially those related to automation and artificial intelligence. Many such tools are either quite inexpensive or even free. In today’s world, internal auditors must leverage these where possible, and there are plenty of affordable tech solutions that automate routine tasks like performing data analysis, tracking follow-ups, or managing audit workflows.
7. Rethink hiring.
When budgets are limited, hiring priorities will be of primary concern — especially for in-demand talent, such as IT and cybersecurity. However, there is room for creativity here. Kramer, for example, recommends paying particular attention to people who have recently left the organization through a buy-out or retirement. “Some people do not like to fully retire,” he says. “They want to continue using their brain. There are wonderful people like this who could help.”
8. Cater to the next generation.
When considering recent college graduates to fill positions, internal audit functions should emphasize the benefits of the job that go beyond money. Small audit functions struggle with this more than most. For example, according to Pulse, 37% of the smallest audit functions do all or most work in person — the highest percentage recorded of the various function sizes. According to a survey by FlexJobs, 84% of millennials and 74% of Gen Z want more flexible remote work options. For more information on what students might look for in a career, check out The IIA’s student resources.
9. Always be learning.
Specialized departmental training does not have to be expensive. In today’s interconnected world, internal auditors have access to more (often free) learning resources than any other generation. Free webinars, industry podcasts, and professional associations are excellent resources for continuous learning, so take advantage of them and schedule regular time for your team to engage with them.
10. Be your own marketing dream team.
CAEs of small audit functions should discuss the value they provide to the organization when interacting with their governing body — and how much more value they could provide with additional budget and resources. “Try creating an annual report two- to-three pages long to show what the department has brought to the company in the last year,” Kramer says. “Intranet, brochures, and newsletters — anything that can promote the department should be leveraged.”
Pride in Accomplishment
No one can deny small audit functions face challenges that their larger peers simply do not. However, there is a certain pride that comes with being a part of a team that operates like a large function. The challenge makes every day much more exciting — and the rush of accomplishment that much more powerful.