The Small Audit Function Playbook: Practical Guidance for Teams Doing More With Less

00:00:02 The IIA

The Institute of Internal Auditors presents All Things Internal Audit.

00:00:06 The IIA

In this episode, Connor Gilchrist talks with Lisa Dalrymple about the challenges small internal audit functions face when implementing the global internal audit standards.

00:00:16 The IIA

They discuss the IA's new guidance for small functions, drawing on Dalrymple's experience rebuilding an internal audit function and working as a solo auditor.

00:00:26 The IIA

The conversation covers independence, quality assurance, documentation, audit planning, limited resources, and practical ways small teams can simplify standards conformance while continuing to deliver value.

00:00:40 Connor Gilchrist

So,

00:00:41 Connor Gilchrist

The topic today is the IA has put out a new guidance called Assisting Small Internal Audit Functions in Implementing the Global Internal Audit Standards.

00:00:50 Connor Gilchrist

It was published a few weeks ago, September 2026, on the IA website, and it replaces the 2011 version.

00:00:58 Connor Gilchrist

So

00:00:59 Connor Gilchrist

I'm going to talk briefly about the guidance, quick little summary of it.

00:01:03 Connor Gilchrist

The guide helps small internal audit functions put the global internal audit standards into practice in a way that fits their size.

00:01:09 Connor Gilchrist

It also explains what makes a function small, then walks through 12 key standards.

00:01:14 Connor Gilchrist

I want to start with your experience back in 2022, because I believe from what you've told me in the past, you started a hospital with no internal audit function, and you were the only auditor for two years.

00:01:25 Connor Gilchrist

Can you explain how you used that old 2011 guide to help in that situation?

00:01:31 Lisa Dalrymple

Sure.

00:01:31 Lisa Dalrymple

Well, in 2022, I started at what was formerly called Hamilton Health.

00:01:38 Lisa Dalrymple

They did have a previous internal auditor, but she was only part-time and had transitioned to compliance director in 2018.

00:01:49 Lisa Dalrymple

And so by the time I got there, hadn't been an auditor for about four years.

00:01:55 Lisa Dalrymple

And then I did find out that she had never

00:01:59 Lisa Dalrymple

really talked about the standards, the senior leadership or with the board.

00:02:04 Lisa Dalrymple

And so it was like starting over from scratch.

00:02:09 Lisa Dalrymple

First thing I did was go through the standards and just see what I needed.

00:02:13 Lisa Dalrymple

And I needed a charter and an audit manual, which I did find an old charter and audit manual dated 2004.

00:02:21 Lisa Dalrymple

So I used all of the excellent guidance at the IIU website.

00:02:27 Lisa Dalrymple

to update the charter.

00:02:30 Lisa Dalrymple

That was how I discovered the 2011 guide and all of my research, looking for guidance on how to run a small department and what I'm supposed to do working by myself.

00:02:41 Lisa Dalrymple

And I found the old small internal audit functions guide and

00:02:48 Lisa Dalrymple

Even though it was related to a previous version of the standards, it helped me to better understand the areas that would be more difficult versus a little easier to do and try to take care of those easy things first and just go through it, check things off as I went, and then make a plan on how I was going to conform to the standards if I even could.

00:03:14 Lisa Dalrymple

And I just went from there.

00:03:17 Connor Gilchrist

Once the new standards come out, we can't use the 2011 guide anymore.

00:03:19 Connor Gilchrist

We have to kind of rebuild it, but use a lot of the same principles and ideas that came from the original 2011 guide.

00:03:26 Connor Gilchrist

I did appreciate the rating system on the old standard.

00:03:30 Connor Gilchrist

I think it was low, medium, high.

00:03:31 Connor Gilchrist

And I basically just kept that the exact same low, medium, high, because I think it will add a lot of confidence to people reading the guidance.

00:03:39 Connor Gilchrist

One of the first ones I mentioned, one of the key standards is the internal audit charter, which is

00:03:45 Connor Gilchrist

Basically, for small internal audit functions, large internal audit functions, it should be pretty much the same process, should be the same level of difficulty.

00:03:53 Connor Gilchrist

You put in what your internal audit function wants to do, puts in some of the key ideas from the start, and then it can be a one-page document.

00:04:01 Connor Gilchrist

It doesn't have to be an entire 18-page manifesto of what you're going to do for the rest of your internal audit functions life.

00:04:07 Connor Gilchrist

It just has to be what are your goals, what is your function going to do,

00:04:10 Connor Gilchrist

and what are the backbones of it.

00:04:12 Connor Gilchrist

So that one is one of the first ones mentioned in the guide and it's a low difficulty.

00:04:16 Connor Gilchrist

Just write a page, just do it.

00:04:17 Connor Gilchrist

You can even use AI to help if you want to, but you didn't hear that from me.

00:04:22 Connor Gilchrist

I also want to mention that something that may affect you with your team currently is that I kind of rephrased what a small internal audit function means by definition.

00:04:31 Connor Gilchrist

So in this guide, I want to say headcount is important, it is part of it, but not just headcount.

00:04:37 Connor Gilchrist

It's about budget.

00:04:38 Connor Gilchrist

It's about closeness to the

00:04:40 Connor Gilchrist

management and the audit board.

00:04:42 Connor Gilchrist

It's about how you're able to kind of map out the entire risk universe that we're trying to do and many other factors such as that.

00:04:49 Connor Gilchrist

So headcount, important, definitely key area, but how you're able to move around the organization, how you're able to do the audits, just as important of being classified as small.

00:04:59 Connor Gilchrist

And there is no key definition of small.

00:05:03 Connor Gilchrist

It's usually dictated by a board, but it can be part of whatever

00:05:07 Connor Gilchrist

whatever situation you're a part of.

00:05:09 Connor Gilchrist

Lisa, did you want to add anything about the practice guide?

00:05:12 Connor Gilchrist

I believe you've had time to look at it a little bit.

00:05:14 Lisa Dalrymple

It's pretty good.

00:05:15 Lisa Dalrymple

And one of the questions that I had was how the IIA decided which standards to include in the guidance.

00:05:24 Connor Gilchrist

Basically, to answer your original question, it's a lot of foundational importance like mandate and charter.

00:05:29 Connor Gilchrist

It's a lot of things that we think will be difficult for small internal audit functions like quality.

00:05:34 Connor Gilchrist

And it's things we think we can help with a lot of new information, a lot of help we can give to people like final communication, overseeing and improving, engaging performance and things like that.

00:05:47 Connor Gilchrist

And as a caveat,

00:05:49 Connor Gilchrist

If you're a small, you still have to abide by all of the standards.

00:05:53 Connor Gilchrist

You do not get, you're not going to pass for the ones that didn't mention because there's a lot of them just because there's not in this guide.

00:05:59 Connor Gilchrist

You have to follow all of them.

00:06:01 Connor Gilchrist

But I kept these as these we think we can help the most people by mentioning, by assisting with, and by, you know, writing more about it.

00:06:09 Connor Gilchrist

So, and I want to ask you, Lisa, we define small a little bit differently now.

00:06:15 Connor Gilchrist

Would you say that definition of small describes your internal audit function currently?

00:06:20 Lisa Dalrymple

Sections about budget and the CAE being involved in audit work, those do apply.

00:06:27 Lisa Dalrymple

We don't have a huge budget.

00:06:28 Lisa Dalrymple

We certainly have enough to pay people and to go to some conferences and educational things, but I don't have a big budget for expensive audit management software and things like that.

00:06:42 Lisa Dalrymple

So just based on

00:06:45 Lisa Dalrymple

I would still think that my size of three auditors in the department is still pretty small, but at least it's not just one anymore.

00:06:51 Lisa Dalrymple

I was able to hire 2 auditors last year, or within the last year.

00:06:56 Lisa Dalrymple

One thing that I was actually very fortunate with when I came here, even though they didn't have a very structured internal audit function, is that they did understand the concept of functional and administrative reporting for the internal audit director.

00:07:12 Lisa Dalrymple

So I do

00:07:15 Lisa Dalrymple

report functionally to the finance and audit committee of the board.

00:07:19 Lisa Dalrymple

I report to the chair of that functionally, and I report to the CFO administratively.

00:07:26 Lisa Dalrymple

So I never had a problem with that, like where I was going to be positioned.

00:07:30 Lisa Dalrymple

So that was in my favor.

00:07:33 Connor Gilchrist

I know in the 2011 guide, it was specifically mentioned one to five auditors in around less than 7,500 hours per year.

00:07:41 Connor Gilchrist

That's a pretty good definition, but I think there's a lot of different factors between the head count and the amount of hours they're doing.

00:07:48 Connor Gilchrist

And I was going to ask, now that you manage two staff and you still do the audit work, you said it's a good amount different than when you're on your own, right?

00:07:56 Connor Gilchrist

You're able to delegate a little more.

00:07:57 Connor Gilchrist

You're able to

00:07:58 Connor Gilchrist

to do more CAE things than where you presume you're on your own.

00:08:02 Connor Gilchrist

You're doing literally everything.

00:08:04 Lisa Dalrymple

Right.

00:08:04 Lisa Dalrymple

Like before, I would have to be very careful to go back over all of my work, make sure I didn't miss anything, use checklists just like mentioned in the guidance document, use checklists to make sure I didn't miss anything, always make sure that I can tie my reports back to documentation.

00:08:25 Lisa Dalrymple

in the work papers.

00:08:26 Lisa Dalrymple

So everything is supported.

00:08:28 Lisa Dalrymple

And I will say it is pretty hard being on your own.

00:08:32 Lisa Dalrymple

But now that I have the two people, I have a little more time to help develop better methodologies with limited financial resources.

00:08:41 Lisa Dalrymple

I did want to mention that when I hired my two people, I utilized the IIA's competency framework to help me

00:08:51 Lisa Dalrymple

in the hiring decision and also it can help with some of their goals for professional growth.

00:08:59 Lisa Dalrymple

And so just wanted to point out other wonderful resources that the IIA has because I really relied on it a lot when I was by myself and first here at the organization and just in general, even now, always checking to see what's updated.

00:09:14 Connor Gilchrist

Small doesn't mean you should be considered immature.

00:09:18 Connor Gilchrist

internal audit function.

00:09:19 Connor Gilchrist

It doesn't lower the bar for independence, doesn't lower the bar for conformance.

00:09:23 Connor Gilchrist

How do you protect your independence when you work so closely with leadership?

00:09:27 Lisa Dalrymple

I don't really feel like I had too many problems with that, except maybe when I very first started where they sometimes people would say, hey, can you help with this?

00:09:38 Lisa Dalrymple

Can you look at that?

00:09:39 Lisa Dalrymple

And I was trying to develop an audit plan based on the highest risks, not just do some special projects for people.

00:09:48 Lisa Dalrymple

And so that didn't take very long to get people on board with understanding how I was going to approach the projects that I worked on.

00:09:58 Lisa Dalrymple

I would say that was my biggest thing when I first started, but we do have a finance and audit committee.

00:10:07 Lisa Dalrymple

And so I meet with them every six months because I have to have time to finish something,

00:10:15 Lisa Dalrymple

And so every six months, and I can meet with the chair anytime and I can meet with the committee without management present.

00:10:27 Lisa Dalrymple

So there are no issues there.

00:10:30 Lisa Dalrymple

I feel like I have it better than some other small functions might.

00:10:35 Lisa Dalrymple

They may not be positioned the same way I am.

00:10:38 Lisa Dalrymple

They may not have access to the board, but I

00:10:43 Lisa Dalrymple

I really think that providing education to senior leadership and the finance and audit committee, in my example, and letting them know about the standards.

00:10:53 Lisa Dalrymple

And one of the very first, in my very first meeting that I had with them, I did a presentation about the standards and why they were important and which, which ones I was already conforming with and which ones I felt like were going to take a little more work.

00:11:09 Lisa Dalrymple

And they were very appreciative of having that understanding because they didn't really know much about it before I told them about it.

00:11:18 Lisa Dalrymple

So that could be a suggestion for other small functions who feel like, I'm not positioned right, I don't have a seat at the table.

00:11:27 Lisa Dalrymple

Maybe people just need to better understand why they need that as an internal auditor.

00:11:35 Connor Gilchrist

Yeah, I completely agree.

00:11:36 Connor Gilchrist

Some people may not be positioned the same way you are.

00:11:40 Connor Gilchrist

And then that's one of the things we talk about in the new practice guide is if you don't feel like you have a seat at the table or you don't feel like you're positionable enough to talk to the board, you have to go through management A lot.

00:11:50 Connor Gilchrist

The practice guide helps in a way to try to make sure you can communicate to the board directly and preserve your independence because that is pretty much the most important thing for internal audit function, preserving that independence.

00:12:01 Lisa Dalrymple

Well, Connor, I have a question for you.

00:12:04 Lisa Dalrymple

In the practice guide, quality assurance is rated high, which I agree, but what does the guide recommend?

00:12:11 Connor Gilchrist

Well, it is rated high, but when you're a team of, let's say 3 auditors, like in your case, and someone mentions the quality assurance and improvement program, it sounds like something you just don't have time to do.

00:12:24 Connor Gilchrist

I have three audits this week, but I would say one of the foundational pieces of this guide is don't treat quality

00:12:31 Connor Gilchrist

Don't treat improvement as a separate project for your audits.

00:12:35 Connor Gilchrist

If you're already reviewing your plans and drafts and audits and keeping that evidence and documentation in one place, you're doing a lot of the work they need to do.

00:12:43 Connor Gilchrist

It just needs to be documented properly and put into a organized system that people can go back to and review if need be, either for a yearly internal quality assessment or a five-year external quality assessment.

00:12:55 Connor Gilchrist

But speaking to the external quality assessment, that's where people really worry, especially about cost.

00:13:01 Connor Gilchrist

I know you mentioned that in the past, and there are cheaper options out there.

00:13:05 Connor Gilchrist

is no quick fix.

00:13:07 Connor Gilchrist

There is no band-aid for this, unfortunately, I wish there was, but there are cheaper options such as teaming up with peer organizations

00:13:13 Connor Gilchrist

to help with EQA.

00:13:15 Connor Gilchrist

But I want to ask you a question, Lisa.

00:13:17 Connor Gilchrist

Because you're on your own for two years, how did you review your work when there was no one else to review it?

00:13:22 Lisa Dalrymple

Well, I went back to my audit program that I have that included all of the standards references in it.

00:13:31 Lisa Dalrymple

And I went through and as I completed the planning, I would just go back through my audit program steps and make sure that everything was completed.

00:13:40 Lisa Dalrymple

Then

00:13:42 Lisa Dalrymple

When I would go through the field work, same thing, just especially the field work, because that's where I'm going to have all my questions and everything that's outstanding and what are the conclusions and just go through and make sure everything was completed and make sure that all findings are supported by the work papers and that there isn't anything that's conjectured.

00:14:04 Lisa Dalrymple

Everything is supported.

00:14:06 Lisa Dalrymple

Everything has been communicated with management.

00:14:09 Lisa Dalrymple

I do management action plans.

00:14:11 Lisa Dalrymple

I don't make recommendations.

00:14:12 Lisa Dalrymple

I know that in some types of organizations, they do make recommendations to management.

00:14:18 Lisa Dalrymple

And I don't do that unless they really have no idea how to fix something, which has never happened here.

00:14:24 Lisa Dalrymple

So for me, follow-ups and wrapping up is pretty easy because they are the ones who say what they're going to do to correct something and then they do it.

00:14:36 The IIA

Small is not a head count.

00:14:38 The IIA

Budget, board access, and the risk of a few people must cover all count just as much.

00:14:44 The IIA

Your function may be small, the profession behind it, it's not.

00:14:48 The IIA

That's what the IIA's reimagined membership is built for.

00:14:51 The IIA

The standards, expertise, and community the profession turns to.

00:14:56 The IIA

So you stay ready as the global internal audit standards reshape the work.

00:15:00 The IIA

Start at the iia.org.

00:15:01 The IIA

Lead what's next.

00:15:03 The IIA

Now, back to Connor and Lisa on how the guide chose its standards.

00:15:09 Lisa Dalrymple

What does the guidance recommend for small teams to handle strategy, the audit plan, and reporting?

00:15:16 Lisa Dalrymple

Because that can seem fairly daunting to a small function.

00:15:20 Connor Gilchrist

One of the key areas of this practice guide is that

00:15:24 Connor Gilchrist

When people hear audit plan, they're like, they may picture a large document, they may picture a complicated document, but I think the more times you can keep it smaller and simpler, the better documentation you have, and also the better your organization and your internal audit function can work.

00:15:42 Connor Gilchrist

Because if someone comes in, you hire someone new, they come in, they can read the strategy, they can read the plan, they can read some of the objectives for the audit, and if it's simple and short, they can read it within a couple minutes and understand what

00:15:54 Connor Gilchrist

you're trying to do versus a long, complicated, legalese type document.

00:15:58 Connor Gilchrist

If you keep it simple, keep it short, and so have everything you need, then that's just as good.

00:16:03 Connor Gilchrist

And you really don't need to make it any longer than it needs to be.

00:16:06 Connor Gilchrist

That's part of the thing about quality and some of the other aspects of the standards that I have in this guide is that if you're able to integrate it along the way, integrate everything you're doing along the way, then it's just going to make things easier.

00:16:18 Connor Gilchrist

It's going to also make things better.

00:16:19 Connor Gilchrist

I think the quality improves when you integrate the quality into every single step before you're doing.

00:16:24 Connor Gilchrist

And I wanted to ask you real quick, when you give a final, like a final audit report, final audit communication to the board, what do they want from you when you give it to them?

00:16:32 Lisa Dalrymple

Well, I do have a standard agenda that is based on first thing I will talk about are the administrative activities, which are like standards conformance, basically, because they're non

00:16:47 Lisa Dalrymple

audit things, but there's still things we need to do.

00:16:50 Lisa Dalrymple

Then I tell them about completed advisory services and go into a little more detail if anything, if there are any significant findings, any significant control weaknesses or areas of risk, but otherwise they're very briefly described, completed audits, and they basically want to know any significant areas of risks or control issues.

00:17:17 Lisa Dalrymple

And then we talk about the action plans and their follow-up status, just to let them know how well everybody is keeping up with their agreed upon action plans.

00:17:30 Lisa Dalrymple

And I started a new internal audit satisfaction survey.

00:17:35 Lisa Dalrymple

So I report the survey results.

00:17:38 Lisa Dalrymple

And then I present the six-month audit plan, which is based on a risk assessment, and I update it

00:17:46 Lisa Dalrymple

periodically as advisory projects are added, then I'll add that into the audit plan.

00:17:51 Lisa Dalrymple

And then I do tell them which projects got pushed because of an advisory or because another audit took a little bit longer than expected.

00:18:02 Lisa Dalrymple

And so those are the things that I tell them about.

00:18:08 Lisa Dalrymple

Their primary concern is the significant areas of risk or control failures, but

00:18:16 Lisa Dalrymple

I provide all the others because I think they need to know that.

00:18:19 Connor Gilchrist

You mentioned that you highlighted and starred parts of the new guide when you read it.

00:18:23 Connor Gilchrist

What stood out to you with this new guide?

00:18:26 Lisa Dalrymple

I did like the notes about building quality into the day-to-day work.

00:18:31 Lisa Dalrymple

I thought that was such a good reminder that it doesn't have to be something you only do at the end of the year because, oh my gosh, I have to report this.

00:18:39 Lisa Dalrymple

And then focusing on the most significant risks and delivering

00:18:44 Lisa Dalrymple

meaningful value to the organization.

00:18:46 Lisa Dalrymple

So things like that were in here, but I think I probably put a star on every section almost.

00:18:53 Lisa Dalrymple

And there were some areas that are marked as noted as high in the guidance that I might not necessarily think were a high difficulty or degree of challenge, but I can see where someone who works at a different type of organization, it could be a much larger challenge for them than it was for me.

00:19:12 Lisa Dalrymple

And unfortunately, the charter

00:19:14 Lisa Dalrymple

And many things can be tailored to your organization.

00:19:17 Lisa Dalrymple

So even if you can't make it exactly like the example, you tailor it.

00:19:23 Lisa Dalrymple

And it's just all about documentation.

00:19:27 Connor Gilchrist

Exactly.

00:19:28 Connor Gilchrist

Auditors always know it's about documentation.

00:19:31 Connor Gilchrist

All right, Lisa, before we sign off, I was going to ask you, what's one thing you think a small team internal auto function should do this week?

00:19:40 Lisa Dalrymple

Well, just remember that it will take time.

00:19:44 Lisa Dalrymple

It's not going to get done all in one day.

00:19:48 Lisa Dalrymple

You will have to take some time away from audit projects or advisory projects to work on standards conformance, but don't make it harder than it needs to be.

00:19:57 Lisa Dalrymple

There are so many great resources out on the IIA website that they really should utilize them if they haven't already.

00:20:05 Lisa Dalrymple

And just approach it, approach standards conformance like an audit, develop a plan, work on it one step at a time.

00:20:13 Lisa Dalrymple

And documentation, documentation, documentation.

00:20:17 Lisa Dalrymple

And what about you?

00:20:18 Connor Gilchrist

Yeah, to build on that, I think one of the simplest thing, but some of the most effective thing to kind of reset your brain for the organization is to look at your actual internal audit charter and go through it.

00:20:29 Connor Gilchrist

No matter if it's a long or short one, it could take one minute, take 20 minutes.

00:20:34 Connor Gilchrist

And after you read it, ask yourself two things.

00:20:36 Connor Gilchrist

Does it still describe how we really work?

00:20:38 Connor Gilchrist

Does it give a clear way to talk to the board without management in the room?

00:20:42 Connor Gilchrist

If the answer to either one is no, that's the first conversation you need to have with your board, like we mentioned independence earlier.

00:20:48 Connor Gilchrist

It's a small step, but so much of independence and credibility for a small team starts with that documentation.

00:20:55 Connor Gilchrist

And honestly, it's an easy way to build some momentum going forward for your small team.

00:20:59 Connor Gilchrist

And then as we've talked about this entire time, I would encourage every single internal auditor to visit the iia.org website.

00:21:06 Connor Gilchrist

And if you're a member, you can download the new practice guide.

00:21:10 Lisa Dalrymple

Sounds good.

00:21:11 Connor Gilchrist

All right.

00:21:12 Connor Gilchrist

Well, thank you, Lisa, for your time.

00:21:14 Connor Gilchrist

You gave a lot of valuable insight that hopefully our listeners will take a lot of some good takes from.

00:21:19 Connor Gilchrist

Have a good day, everyone.

00:21:21 Lisa Dalrymple

Thank you.

00:21:23 The IIA

If you like this podcast, please subscribe and rate us.

00:21:25 The IIA

You can subscribe wherever you get your podcasts.

00:21:28 The IIA

You can also catch other episodes on YouTube or at the IIA.org.

00:21:32 The IIA

That's T-H-E-I-A.org.