Interested in this topic? Visit the links below for more resources:
Visit The IIA’s website or YouTube channel for related topics and more.
00:00:02 The IIA
The Institute of Internal Auditors presents all things internal audit in this episode, Pamela Strobel, Powers and James Rose Unpacked the new global practice guide, developing an internal audit strategy created to support standard 9.2 in the global internal audit standards. They discuss why strategy is essential for internal audit.
00:00:23 The IIA
Functions. How it differs from the audit plan and the importance of foresight, scenario analysis and continuous development.
00:00:30 The IIA
They also discuss the connection between strategy and performance measurement and how these tools help internal auditors stay aligned with organizational objectives.
00:00:42 Pamela Stroebel Powers
James, can you talk a little bit to our audience today about why it was so important to the Standards Board that we include this new standard on internal audit strategy?
00:00:51 James Rose
So in terms of setting an internal strategy and just having that, that standard kind of goes back to the the domain, you know managing the function and then that core principle above it, you know, actually physically if we're not thinking about our strategy as a department, we can't continuously improve and we can't align what we're doing.
00:01:13 James Rose
So the organization's overall strategy at the end of the day, we're here to help the organization meet its strategic objectives. That's in the the purpose of of internal auditing. And so in order to to align to that, we've got to have our.
00:01:25 James Rose
Own strategy plus.
00:01:27 James Rose
You go out and we audit every button and saying, what's your strategy? It's fair for them to turn around and ask us what's our internal audit.
00:01:33 Pamela Stroebel Powers
Strategy. One of our goals when we developed this practice guide to help audit practitioners as specifically internal audit functions around developing their strategy was we really wanted to specify how this was specific to developing a strategy for an internal audit function. Can you specify some of the aspects of the guide that you think help distinguish?
00:01:55 Pamela Stroebel Powers
This guide specifically to an internal audit function versus just to an overall organic.
00:02:00 Pamela Stroebel Powers
Nation.
00:02:01 James Rose
In terms of the internal audit strategy versus the the large organization, our focus is on good governance. Then the day the whole aspect of internal learning is how do we help the organization have good or great governance. And so when you take that as a focus, our strategy gets into those components of good governance.
00:02:22 James Rose
You know our relationship with the board with the audit committee, whatever the governing organization is our relationship with management and management's expectations and that our relationship to governance, risk and control process.
00:02:37 James Rose
And then and then into the heart of the strategy is, how do we beat, you know, build up our audit function, the staff, our methodologies, our processes and our communication in order to achieve what our role is in the organization, which is a component of the.
00:02:57 James Rose
Overall organization, strategy and objective.
00:03:00 James Rose
And so it's important for us to have our own strategy about how we're going to achieve that, what does good governance need to be in our organization and our industry and our sector and our country or region. And then what does that in turn mean in terms of what we need to be building out. And there's a concept here.
00:03:20 James Rose
That we're always under.
00:03:22 James Rose
Development. I mean the organization is always in their development. We as an audit function are always under development. And so what's the next thing that we need to either improve on or look out into the future in the next couple of years and say we need to be ready for that because that's where the organization is going and that's a component of.
00:03:39 James Rose
Our strategy that we're working on.
00:03:42 Pamela Stroebel Powers
I love the concept of underdevelopment or always under development.
00:03:45 The IIA
And I always I.
00:03:46 Pamela Stroebel Powers
Tend to focus on and we'll talk maybe a little bit in a minute about umm performance measurement, but I always think about continuous improvement. How are we always trying to do better? So I I love that concept James. So an example of a way that we did try to modify what we gave you guidance in that might be a little bit different than you're expecting. So one of the typical.
00:04:06 Pamela Stroebel Powers
Components of an internal or a typical organization strategy you would be is to seeing his mission. What's the mission of the organization? Well, as James was talking about as as you were describing James, we really wanted to align with the mission of the organization. That's what internal audit function is about. That's our our primary.
00:04:24 Pamela Stroebel Powers
Objective so we didn't need to repeat a mission. However, we would want to apply the purpose and most likely the purpose statement out of the standards. But maybe you have a even a more specific purpose for your organization that you want to apply there. So although we gave you definitely a road map, we tried to give you some examples, some templates.
00:04:44 Pamela Stroebel Powers
We're really hoping that our audience sees fit to make the make it work for them. And you mentioned the overarching principle principle 9 plants.
00:04:55 Pamela Stroebel Powers
Strategically, the next standard after strategy is around the internal audit plan. Can you talk a little bit about the differences between the two requirements about the difference between a requirement for a strategy and a requirement for an internal audit plan strategy being a newer emphasis, internal audit plan being something we're used to that's been around for a long time.
00:05:15 James Rose
The auto plane is just that that.
00:05:16 James Rose
How or the other?
00:05:17 James Rose
I'm sorry, the what we're going to do is the thing the engagements that we're going to go execute, but then they you've got to roll that up into the bigger picture about you know, First off, what does that mean in terms of good governance for the organization? And so strategically, what's our role in terms of what the board expects?
00:05:35 James Rose
And how do we, you know, develop the capabilities for the function to execute that overall, you know guidance back to the board and the actual engagements that support that guidance and so you know give you an example, we knew that our organization was it, it was in the healthcare space.
00:05:57 James Rose
Was morphing it from more payer focused insurance type of rubric. It's more of an actual direct delivery rubric where we're actually hiring providers and other folks to to drive, you know, healthcare.
00:06:13 James Rose
And so the audit function had to start thinking about, well, if that's where the organization is going to be in a couple years, what type of staffing do we need. So we needed to hire nurses and other types of practitioners and we were asked to do that at the time we were. We were making that transition. A lot of folks in the executive leadership or maybe.
00:06:34 James Rose
The board may even scratch their heads. Why is the audit department hiring nurses?
00:06:38 James Rose
But when we thought about good governance and organization providing the assurance model we needed, we needed to think out-of-the-box in terms of where do we need to be. The other thing that we saw was the onslaught of of more and more regulations and the complexity of trying to keep track.
00:06:57 James Rose
Of all that?
00:06:58 James Rose
So our audit group drove strategically introduction of a GRC platform and system to help tie together all the regulations and governance and risk management.
00:07:09 James Rose
And controls both to support that regulatory oversight, but also it's our Pasic annual financial Control reviews, which was getting, you know, very complex to manage on spreadsheets. So again, those are strategic initiatives of the organization from an HR domain, from a technology domain.
00:07:30 James Rose
Which we needed to have, which had nothing to.
00:07:32 James Rose
Do with the audit.
00:07:33 James Rose
Plan. And so that's the distinction there. What are the what are the capabilities that you're building strategically in order to meet your strategic goals with the board? And then your audit plans, just that the list of engagements you're going to do and how they kind of tie together. So in our mind at the Standards Board, those are very easy.
00:07:54 James Rose
To to decipher two different components and we just probably haven't talked as much to practitioners about that.
00:08:01 Pamela Stroebel Powers
You also made some really good tie in points there with some of the other elements of the standards and why this strategy becomes so important. And when we look at our purpose of internal auditing, we we use the word foresight and we've actually also gotten feedback about helping to find foresight. And you just described it perfectly as you were beginning to answer that question for me.
00:08:23 Pamela Stroebel Powers
Looking forward, what's going to possibly be happening with the organization in the future? We're already used to looking at risk management and thinking about what could be coming happening, what are our future objectives? Where are we trying to go and that by setting a strategy helps make sure that the internal audit function is following that purpose. And then you also brought up.
00:08:42 Pamela Stroebel Powers
I'm sure unintentionally a couple of other standards that are near and dear to our heart and the 10 series 10.2 and 10.3 around the internal audit function, being able having a strategy helps us really.
00:08:54 Pamela Stroebel Powers
Inc practically about what our human resources needs are, what our information technology needs are that help us do that planning and making sure that we're having those conversations with our board and all of that. So perfect to tie INS. Thank you, James. So James and I, you and I have had a really good time over the last quite a few years working together as part of the team.
00:09:16 Pamela Stroebel Powers
To develop the standards and then moving on and working on both the performance measures tool as well as this strategy global.
00:09:23 Pamela Stroebel Powers
This guide, so we've gotten to know each other quite well and and we actually had a a robust team on this project with three Standards Board members as well as a couple of gentlemen from Germany that had gone through this really robust process of developing a strategy. So they sat and helped us on this team. One thing I learned about you.
00:09:44 Pamela Stroebel Powers
Games is your personal interest and passion around scenario analysis and how that can feed into strategy. So I was hoping to give you an opportunity to talk a little bit about why why you believe that's such an important tie into.
00:09:58 James Rose
To me, it's important because strategy and and this goes back way back to. I was lucky enough to take a strategic management course at at at Chicago University of Chicago, you know, around developing corporate strategy and the component there was you know from the get go they they talked about.
00:10:19 James Rose
Now, as the CEO developing a strategy, the bottom line is you're trying to predict the future. The job of the CEO is to predict the future and then to put in the capabilities to seize that future environment.
00:10:32 James Rose
That's no different for the internal audit function. Your job is actually to predict the future. We know that we're not perfect at predicting the future, right? So what we can do since we know we can't definitively predict the future is you can say, but I know with some degree of of competence that.
00:10:52 James Rose
One of a couple of things.
00:10:54 James Rose
Going to happen, you know, we're going to go in this direction or maybe a little bit to the left or the right. These are, you know, scenarios. And so the perfect strategy is where you sit down and just think about, OK, the next five years here are the top 2345 things that could potentially happen. Those are your scenarios and then you lay those down and say, OK, if I want to.
00:11:16 James Rose
Cell as an internal audit function.
00:11:19 James Rose
In all five of those scenarios, you know what's the best possible initiatives I can put in.
00:11:25 James Rose
Place.
00:11:26 James Rose
Now I may not be able to have the resources to deal with all of them, but what's the one that you know like in my earlier example, nursing a nurse practitioner? If we ended up not going into more, you know, direct clinical care?
00:11:40 James Rose
I could have figured out how to use those nurses on insurance, you know, reviews or claims reviews or other things. As it turned out, because we saw with the organization could potentially go and had those folks in.
00:11:52 James Rose
Place the next year we immediately got tagged to help with something only a clinician could do. I had this brand new nurse's been with us for about a year, sitting across from VP's, telling them what was in and out in terms of their budget. Based on, you know, our auditing for a specific regulatory.
00:12:13 James Rose
Requirement in in the US jurisdiction and so that was where because of we had that scenario analysis in place.
00:12:21 James Rose
We took a gamble every everything is a gamble when you're looking forward to go ahead and hire a nurse and we figure out how to use them because we didn't exactly know what we're going to do, that we were in this perfect spot to be able to add value to the organization because of that nurse sitting in our independent audit function that the controller felt very comfortable.
00:12:41 James Rose
Letting us, you know, make sure that we were helping. Audit what? What needed to be done for management.
00:12:47 James Rose
So that's just one, you know, example. And so you can think about any organization. They don't know exactly what's going to happen over the next couple of years. So you lay out, you know, where this and this goes back to where we started out with the corporate strategy versus internal audit function. So you have to kind of apply your thinking to the corporation overall corporation.
00:13:07 James Rose
The public entity, whatever the case, is to your overall organization and then think about, OK, if if the organizations go in these potential three or four areas, then how is the audit function? What are the three or four areas we need to go into?
00:13:20 James Rose
Do and then what's the best option in terms of our initiatives using the resources that we have and that's also, you know, one of the other standards about communicating to the board, this may be where you go to the board and say these are the five best scenarios that hearing you all say about where the organization may go. I got 2 and 3 covered, but these other two.
00:13:41 James Rose
I don't have squat to help you there unless we change something in the budget. I go hire somebody different. You know where the case may be. And so it also sets up a good conversation so you don't get surprised or surprise your.
00:13:54 James Rose
Board when you know a year down the road, they go in a direction as organization. You're caught flat footed because you can't really provide assurance in that space because you don't have the talent back to your use of the word foresight and and pointed out. And the purpose of internal auditing that was probably the most the only and the biggest significant change.
00:14:16 James Rose
We made by adding foresight to the purpose.
00:14:19 James Rose
And the idea is that the internal audit function is about predicting the future in terms of our governance, risk control model and how well we're going to apply and be able to apply good governance in that space. So there, that's how long would it answer to why scenario analysis is important.
00:14:39 James Rose
But how it ties in foresight in terms of the purpose and strategy in terms of all those things we need to do to be sure we're we're ready to provide with the organization at times may not even sell quite understand what it's going to need down the road.
00:14:56 Pamela Stroebel Powers
Absolutely. Wouldn't it be nice, though, James, if we had a nice internal audit crystal ball and we could just set that up and look at how our organization. Here's what's coming. Yes, somebody should invent that. That seems like a I it seems like that's our next step, right, so.
00:15:04 James Rose
Right, right.
00:15:16 James Rose
OK.
00:15:17 Pamela Stroebel Powers
Excellent. So before we wrap up our conversation today.
00:15:21 Pamela Stroebel Powers
I would like to talk a little bit about I alluded to. So James, you and I worked together prior to the strategy global practice guide. We also worked on an issue that and issued another tool, the other standard that was quote UN quote knew a leading practice that many internal audit functions did, but it wasn't required.
00:15:42 Pamela Stroebel Powers
And the standards is 12.2 performance measurement.
00:15:45 Pamela Stroebel Powers
Uh so since?
00:15:46 Pamela Stroebel Powers
You were on both teams. I was hoping you might be able to talk a little bit today about how might an internal audit function use both this developing an internal audit strategy, global practice guide and that performance measure tool. How are they aligned so that they can use that to effectively both set their strategy and measure their progress?
00:16:04 The IIA
Towards it.
00:16:06 James Rose
Well, and if?
00:16:07 James Rose
You set the strategy. Here's our scenarios down the road. And so here's our initiatives to get there. So you've got to, when I think about initiatives, we can easily get stuck into putting forth initiatives which are the standard, you know, what percentage of the audit plan am I going to get done or you know what type of staffing?
00:16:27 James Rose
They're higher as opposed to the more strategic initiatives around what's our overall audit coverage or how do we achieve the mandate type of thing. So once we we think about the initiatives then we we want to measure those initial.
00:16:40 James Rose
And that's where performance measures come in place, both forward-looking and and rear view looking performance measures and so their their performance measures that can be you know ones that are they're truly expected to hit and there can be aspirational and performance measures and so we need to be clear about you know the distinction between the two.
00:17:00 James Rose
I hate when folks say, well, we don't want to put that performance measure out there because we we might not be able to meet it. Well, now that it's still directionally correct, you know, we don't have to like weigh our entire bonus on that mission. Yeah, that measure you know, so that's one of the things we were clear in the guidance in 12.
00:17:16 James Rose
Do is that there's some measures that may be the core ones that actually get into your bonus plan that actually get reported to the board and there's some that may be internal to just your your function that are more aspirational and that if you look up in the the consideration section and and 12.2, you're right off the top, the two that they were actually put in order.
00:17:37 James Rose
In a very purposeful way, you're the first one is coverage of engagement objectives expected to be reviewed according to the internal water mandate. So what does the board expect you to do? The overall mandate? And so we should have performance measures around achieve.
00:17:52 James Rose
Knows and our strategy and initiatives are around making sure we've got all the resources in place and talent to do that. And then the second one is more aspirational, the extent to which the in Toronto conclusions at the level of the business unit organization address significant objectives in the organization. The idea there is that.
00:18:12 James Rose
That is a comprehensive OPA.
00:18:15 James Rose
On all the material risks to the organization and whether they're well managed, yes or no, they're not allowed to audit functions that are at that level today. You know, some are doing financial, some are doing a slice of compliance. No one's giving a comprehensive assessment of governance across objectives.
00:18:34 James Rose
Financial compliance, you know, financial goals, customer goals, that's your aspirational, you know driver and that's purposefully listed as the number 2, you know measure in the consideration section of the standard.
00:18:50 James Rose
And so then you bring that back to our strategy conversation here. You know, that's why it's important that we tie the strategy and the organization and understand what the overall objectives of the organization are back to, how we can provide a comprehensive opinion to the organization.
00:19:09 James Rose
And that's the the, you know, the aspirational performance measure there is, how can we give a comprehensive opinion and there's so many internal art organizations which aren't really doing that, and they're focused on the financial controls or excisive compliance. And we really want aspirationally.
00:19:26 James Rose
To look at the overall risk securitization, so how can we provide that comprehensive, you know opinion and so that's an aspirational performance measure which ties into our aspirational strategy looking forward. And so that that's how those those tie in from my perspective at least.
00:19:46 James Rose
And so again, you know, this summarize performance measures kind of are the end tag to where our strategy is going, what those initiatives are. There's some performance measures that you're expected to head because they're in your bonus or what the board.
00:19:59 James Rose
Aspects. There's some performance measures that are aspirational, and that's fine too. And so those are more directionally you want to keep moving, you know forward on those, but some years you may step get step back to other years, couple steps forward. That's fine too.
00:20:12 Pamela Stroebel Powers
And the government, it's less of a bonus and more of a pat on the back, but yes that.
00:20:15 James Rose
Right, right. Sure, sure, exactly, exactly. It's the case made.
00:20:19 James Rose
00:20:39 James Rose
And our standard?
00:20:40 James Rose
They're developed to fit any organization on the planet, so it's just a matter of stepping back and understanding the context, and then then applying them correctly.
00:20:51 Pamela Stroebel Powers
Absolutely. You. You made the point again in the in that going back to your response, when we very first started this discussion on thinking about under development or continuous improvement, that's really what performance measurement about is about. It shouldn't just if you're all reporting green like you've made all of your performance measure targets, you're not.
00:21:11 Pamela Stroebel Powers
Pushing yourself and the idea of the strategy is to help you help. I loved your aspirational get aspirational be. Be excited about what's.
00:21:20 Pamela Stroebel Powers
Great. So I really, really appreciate your time and being here with me today, James. I do just want to wrap up and make sure that we mentioned again, we do have that new internal audit strategy, global practice guide that is out there for our Members. We're hoping as part of the IPPF that that helps you specifically with standard 9.2.
00:21:40 Pamela Stroebel Powers
We also have three companion tools with that we have a template.
00:21:44 Pamela Stroebel Powers
That that, we really recommend that that's really if your organization does not have its own strategic plan already, we recommend that you use the same format that they use so that it feels to them like it's part of their organization when you're working with your board and your management, you don't want it to feel like this is this foreign thing, that internal audit is doing, no. This is part of our organization.
00:22:06 Pamela Stroebel Powers
But if you don't have a template, if your organization doesn't have something, we've provided one for you as well as case studies that are specific to developing an internal audit strategy in.
00:22:16 Pamela Stroebel Powers
That I find an example financial services organization and an example public sector organizations. So we're hoping that those tools help you out as well as we also mentioned the performance measurement tool which just has set, James gave you several examples, but it has lots of performance measures you can pick from or used to develop your own.
00:22:36 Pamela Stroebel Powers
These are just a starting point there to help you get started. If you have interest in specifically, maybe what James as you share about scenario analysis. If people want more on that, we encourage you to do your own research. There's lots and lots and lots.
00:22:49 Pamela Stroebel Powers
Much of information out there on developing a strategy, so go out there, see how you can apply even more of that to continuously improve and develop your internal audit function strategy. So thanks again at James and a shout out to the other task force members that worked with us on both of these tools. We appreciate.
00:23:09 Pamela Stroebel Powers
Everything that you, and especially the Standards Board members do for our profession.
00:23:17 The IIA
Fraud is getting trickier, but you can stay ahead. Join US online for the 2026 fraud on Massed Virtual Conference on February 17th. It's one pack day of practical tips, expert insights, and 13 plus CP's. So save your spot today and register at theia.org.
00:23:38 The IIA
If you like this podcast, please subscribe and rate US. You can subscribe wherever you get your podcasts. You can also catch other episodes on YouTube or at theia.org. That's theia.org.
