Reenvisioning Internal Audit: Part 1
Reenvisioning Internal Audit is a four-part series studying different approaches for internal audit leaders and audit committees to consider as they look forward and reimagine what the new normal for internal audit functions may look like.
The COVID-19 pandemic brought tremendous changes to individuals, families, businesses, and organizations. We, as a global society, have been heavily impacted by this event. Death, sickness, unemployment, lock-downs, travel restrictions, quarantines, businesses closing, schools moving to online learning, remote work situations, and significantly reduced personal connection are all scenarios that have become the “new normal” in our society.
Businesses and organizations have had to pivot and adjust quickly due to the ongoing rapid spread of the virus. Business continuity plans have been dusted off and enacted upon. Workforce protection measures are now in place, including remote working, social distancing, testing, contact tracing, and virus spread prevention methods. Some businesses have closed altogether. Worker availability and infections have stressed business operations and supply chains. Reduced revenues, cost structure changes, and inefficiencies have challenged the financial health and liquidity of businesses. These and other factors have forced a new set of pressures on business and government leaders.
COVID-19 has also brought about significant changes to internal audit functions. Based on the April 2020 IIA survey on the COVID-19 Impact on Internal Audit[i], many internal audit functions faced audit plan scope reductions, budget cutbacks, staffing reductions (temporary and permanent), co-source reductions, and redirected activities. Internal audit staff have even taken on roles to help with business activities during these trying times.
As we look forward to determining what the new normal for internal audit functions will be, we find ourselves at a crossroads. What will the new normal for businesses and organizations look like? How will internal audit functions pivot to follow suit? How can internal audit functions reemerge to be more effective and more efficient considering the challenges of living in a pandemic stricken world? How do audit plans get completed with remote workers and travel restrictions? Can internal audit functions effectively meet compliance requirements, such as Sarbanes-Oxley facing these challenges? The answers to these questions, and more, are at the top of agendas for chief auditors, audit function leaders, and audit committees globally.
Granted as we work to determine what the future will look like for our businesses and organizations, the approach for each audit function will be driven by each business or organization's approach to emerge and thrive in the new normal. So, as we study four different approaches aimed at reenvisioning internal audit: Lean, Agile, Innovation, and Effectiveness, understand that the right approach will vary based on function maturity, organization culture, resources, talent, technology, budget, industry, geography, and other prevailing factors. Also, note that the right approach may end up being a hybrid based on these and other factors.
Let’s begin our journey to reenvisioning by discussing the application of Lean principles in an internal audit function.
LEAN
Lean principles, originally translated from the Toyota system of manufacturing, are comprised of components focusing on customer value, the value stream, flow, pull, and perfection. All-in-all the Lean method is summarized as a way to do more and more with less and less.[ii] Some benefits observed from Lean techniques include:
Reduction in: Defects, Costs, Lead times, Inventories, and Waste;
Improvement in: Customer Satisfaction, Productivity, Responsiveness, Quality, and Capacity.
Reductions and improvements in these areas can all bring positive changes to the internal audit function and its perception. In applying Lean principles to Internal Audit, one should consider the application of each of the following lean principles:
Customer Value – understanding what the customer sees as value will be different for every audit performed in every area of the business. After performing initial planning and brainstorming, audit teams must work with auditees (customers) upfront to understand pain points, perceptions, bottlenecks, risks, and objectives for audits. Audit activities need to be focused on improving or eliminating those pain points, risks, and bottlenecks from the business. Reduction or elimination of these lead to customer value perception from the audit. For example:
a customer can utilize methods used during the audit going forward to identify issues or make improvements to controls proactively
a customer shares audit observations and recommendations with peers to propagate improvements across the business
we have also seen examples where the business adopted analytical scripts used in an audit to implement a monitoring control based on daily exception reporting
Value Stream – auditors should identify and map the current state of the value stream and determine the future state by challenging all process and information steps. Next, they should look at ways to eliminate waste and inefficiencies. For instance:
performing more frequent and focused risk assessments that actively identify risks pertinent to the business or organization
ensuring that testing approaches are balanced with the inherent risk
investing resources to perform thorough root cause analysis to detect the underlying source of issues
streamlining the audit reporting process to report only information valuable to the stakeholders
implementing a quarterly risk assessment update process that allows the internal audit function to identify emerging risks and focus resources on key risks impacting the business
we have also seen that streamlining reporting requirements will enable auditors to spend more time auditing and adding value with less time spent on word-smithing reports
Flow – after the future state value stream is determined, ensure that activities flow smoothly and accurately. The Flow stage is where interruptions, delays, and bottlenecks in the future state process are detected. Examples include:
verifying proper streamlined processes are in place for planning, communication, testing, root cause analysis, and reporting activities
enabling proactive communication touchpoints with the customer
ensuring the use of only applicable audit steps, sampling and testing based on the risk profile
developing a reporting process that brings value to the customer
Electronic auditing platforms can have a significant impact on flow, but make sure that Lean principles are applied to the process. Ensure unnecessary and unused information is not required to be populated. We have also experienced that frequent touchpoints with the customer opens lines of communication around observations and can quickly squash false positives, reducing the waste of auditor’s time chasing ghosts.
Pull – this principle is based on the premise that if the principles above are in place, then the delivery of products (audits) is much easier and can be performed in a just-in-time manner. Pull, in combination with the other principles, enables audit teams to be more nimble with the audit approach, while still performing the required steps to complete the audit. Examples include:
investing the right amount of time in the audit – not just the standard four weeks
open, ongoing communication of observations with the customer to reduce the reporting back-and-forth at the end of the audit
Applying the pull principle has proven to reduce the time investment on audits by using just-in-time theory. We have seen that a reduction in scope for less risky audits allows for a more nimble approach. Also increasing upfront planning, utilizing analytics, and upfront communication increases efficiency for reoccurring audit programs.
Perfection – as actor Michael J. Fox so eloquently put it, “I am careful not to confuse excellence with perfection. Excellence, I can reach for; perfection is God’s business.” Although the principle is perfection, the premise behind it is continuous improvement and propagation of Lean thinking. Perfection is the principle for continuously improving your processes. As we eliminate one bottleneck in the process, another will inevitably show its head. Not settling for the status quo is key to Lean thinking. Internal audit functions are a mix of career auditors and new recruits doing their time to move on to the next adventure inside or outside the organization. As a profession, complacency is a risk. Internal Audit functions must keep up and align themselves with the changing profiles and strategies of the business or organization. Still, they must also keep up with external developments that may impact their function and the organization. Complacency is subdued by continually striving to reinvent and re-envision the internal audit function.
As you can see, there are benefits derived from applying Lean principles to the internal function. Reductions in costs and waste combined with increases in quality, productivity, and customer satisfaction are a definite step in the right direction. But wait, before going out and starting up a Lean initiative, let’s continue our journey in reenvisioning internal audit.
In part two of this series, we will discuss the application of the Agile project methodology to internal audit functions.
[i] (2020). Retrieved 4 August 2020, from https://dl.theiia.org/AECPublic/COVID-19-Quick-Poll-Results-April-17-2020.pdf
[ii] Lean manufacturing. (2020). Retrieved 3 August 2020, from https://en.wikipedia.org/wiki/Lean_manufacturing