Modern internal audit is an important component of effective corporate governance. Its purpose, according to the 2017 International Professional Practices Framework is to “enhance and protect organisational value by providing stakeholders with risk-based, objective and reliable assurance, advice, and insight.”
This positions the modern internal auditor as a trusted advisor to company boards, audit and risk committees and management and is a key ingredient in helping the organisation meet its strategic objectives.
The “modern” internal auditor
The modern internal auditor delivers value through providing independent, objective assurance and consulting services designed to identify and mitigate risk and improve an organisation’s operations. These professionals help an organisation accomplish its objectives through a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
Now more than ever, businesses rely on internal audit to navigate today’s complex and ever-changing technological, environmental and regulatory landscape and add value to organisations through proactive insight and advice. This requires the modern internal auditor to work in strategic partnership with the organisation and think outside the box to help identify, interpret and understand risks and opportunities and advise on possible courses of action.
Internal audit drives positive organisational change
Not only does the modern internal auditor leverage the work of risk management to direct planning, but these professionals also play a key role in contributing to the improvement of the risk management process. As a result, the modern internal auditor can be a facilitator of positive organisational change due to their birds-eye view of the organisation and breadth of expertise. Importantly, this includes recognising the upside of risk through a forward-looking lens and understanding ‘what can go right’, which plays an important role in the development of organisational strategy.
The evolution of modern internal audit brings many benefits to an organisation; however, these higher expectations also bring certain obstacles and misconceptions. It’s, therefore, critical that internal auditors and organisations understand and address these issues. Below, we’ve outlined a couple of key steps which will help businesses get the most out of their internal audit engagements.
Providing a seat at the table
Traditionally, internal audit has had limited engagement with different areas of the business. This can create misconceptions and a misunderstanding of what internal audit is and how it can be effectively leveraged.
To mitigate misunderstanding about internal audit, businesses should facilitate the ability for internal auditors to establish relationships across all areas of the business. Building these relationships helps organisations to challenge historic thinking and consider areas of value outside a traditional internal audit program. With executive support, the internal auditor should attend leadership meetings, strategy days, project steering committees and other forums to gain deeper insights and be in a position to provide advice across the business in real-time. This assists the business by gaining a holistic audit approach and building relationships with advisors who can respond to changing organisational needs and expectations.
Striking a balance
An internal auditor must take care not to compromise objectivity, by, for example, providing assurance over their work, or taking on a management role. The historical approach to dealing with such challenges was to limit the work of internal audit to provide assurance services over past performance only (i.e. compliance). This inherently reduced the ability to provide forward-looking insight and advice to a business, which limits the value produced by internal audit.
To ensure businesses get as much value as possible out of their internal audit programs, well-established safeguards can be implemented. These safeguards include:
- making internal audit responsibilities clear (through the Internal Audit Charter)
- assessing whether the internal auditor has the required skills and knowledge to advise on certain matters
- ensuring internal auditors understand and adhere to their obligations under the Institute of Internal Auditors International Professional Practices Framework.
Once the structural roadblocks are addressed in an organisation, there’s an opportunity for the internal auditor to work in close partnership with the organisation as a trusted advisor, which often produces the most meaningful results for businesses before, during and long after the audit program concludes. To ensure your business engages in an audit program that realises value across the business, make sure your internal auditor can:
- extend their reach to addresses complex business issues
- deal with the required subject matter or leverage a network of experts
- recognise that controls come at a cost and understand the importance of balancing process efficiency
- consider qualitative information and soft controls such as the effects of organisational culture on achieving business objectives
- assist the organisation in identifying and responding to emerging and risks and opportunities.
Looking forward to identify opportunities and implement change
Encouragingly, we are seeing businesses increasingly recognise the value of internal audit and, as a result, are increasing the breadth of their internal audit activities to drive organisational change.
Contact one of our specialists below if you’d like to discuss how internal audit may be able to help your organisation.
