Reenvisioning Internal Audit: Part 4

Reenvisioning+wordcloud.jpg

Reenvisioning Internal Audit is a four-part series studying different approaches for internal audit leaders and audit committees to consider as they look forward and reimagine what internal audit functions may look like in the future.

The events of 2020 have left us to look towards a new normal. A new normal for life. A new normal for education. A new normal for work. A new normal for business. And for audit function leaders, a new normal for internal audit functions. How will internal audit functions pivot to follow suit with organizations as they adapt to a new normal? How can internal audit functions reemerge to be more effective and more efficient considering the challenges of living in a pandemic stricken world? What emerging technologies can benefit internal audit where travel is restricted and human interaction is distanced? How does internal audit continue to provide assurance, insight, and value to the business during these unusual times and beyond? The answers to these questions, and more, are at the top of agendas for chief auditors, audit function leaders, and audit committees globally.

Granted, as we try to understand what the future will look like, each audit function’s approach will be driven by each business or organization’s approach to emerge and thrive in the new normal. As we study these four different approaches to reenvisioning internal audit: Lean, Agile, Innovation, and Effectiveness, understand that the right direction will vary based on function maturity, organization culture, resources, talent, technology, budget, industry, geography, and other prevailing factors. Also, note that the right approach may be a hybrid based on these and other factors.

Let’s continue our journey to reenvisioning by discussing some thoughts on increasing the internal audit function’s overall effectiveness.

EFFECTIVENESS

Similar to Innovation, Effectiveness in internal auditing is an approach of transforming people, processes, and technologies within the internal audit function to effectively align it with the changes of the business. The central theme to the Effectiveness section is Focus.  Internal audit leaders now, more than ever, need to keep a sharp focus on the internal audit function, on the organization, on governance and risk mangement, and on internal and external risks impacting the organization. In this section, we will discuss five areas that drive the effectiveness of internal audit – increasing the velocity of risk identification, aligning internal audit with the business, being quality-driven, being cost-focused, and being service-driven. While these may not be part of a standard methodology, similar to Lean or Agile, employing each of these recommendations in varying degrees can add to an internal audit function’s overall effectiveness.

Velocity of Risk Identification – as many experienced with the rampant spread of COVID-19 this year and the resultant shutdowns, supply chain disruptions, and worker quarantines, businesses had to pivot quickly to remain viable. To effectively support Boards and executive teams, the sooner risks and emerging risks are identified, the sooner a plan to manage the risk can be developed and adopted. Quicker risk identification is not just focused on new, big, gnarly emerging risks; it is also applicable to finding external and internal impacts to previously identified and ranked risks. Internal audit leaders must rethink the standard, once-a-year risk assessment process to improve risk identification timeliness. What does this mean?  A quarterly risk assessment process? A routine, yet also, event-based risk assessment process? Even an ongoing risk assessment process? Each of these, and others, allow fluidity to adding, deleting, and ranking risks within the organization’s risk universe. Must every risk be identified?  No, not possible, but the process of assessing real-time events, organization health, black swans, and other factors frequently allows executive teams and Boards to better prepare for potentially relevant risks that may impact the organization.

Alignment with the Business – a key component to any internal audit function’s effectiveness is how closely it aligns itself with the organization’s mission, objectives, strategy, and operating characteristics. As the current business environment changes, internal audit functions need to assess their plans and priorities accordingly. By being dynamic and capable of pivoting, internal audit functions can provide executive teams and Boards with up-to-date and applicable information aligned with business needs, business strategy, and current obstacles.

Quality Driven – quality has been a staple in industry since the 1940’s. Models and concepts from Deming, Juran, TQM, Kaizen, etc. have been around since the early 50’s. The Six Sigma approach, born within Motorola and the International Organization for Standardization (ISO), has been around for nearly 40 years. And there are many more concepts available. What is quality for an internal audit function?

The Institute of Internal Auditors (IIA) established benchmarks for internal audit function performance through a series of standards – the International Professional Practices Framework (IPPF)[i]. To conform with the IPPF, internal audit functions must adopt the standards and guidance and have an external quality assessment review (QAR) at least every five years. These reviews, performed by third-party, IIA trained professionals, provide a benchmark against the standards and provide specific opportunities for improvement.

Along with the quality assessment review process measuring the function against the IPPF, internal audit functions can also adopt other quality models and concepts, either ones already prevalent within the organization or ones that may be of better cultural and operational fit. Remember to consider Lean and Agile concepts discussed earlier in this series. Quality should be a benefit of a well-designed process, not an additional layer to burden your team.  Quality is an organizational mindset and must come from the top.

No matter the direction taken, quality does not just appear; it has to be woven into the design and framework of the people, process, and technology of the work performed. Ultimately, a quality program aims to provide stakeholders with the most accurate and beneficial information quickly and efficiently while adhering to the applicable standards and guidance.

Cost Focus – internal audit functions are typically, I reiterate, typically an overhead cost to the business. There are remote instances where the function can be a revenue stream, for example:

  • a case where auditors are co-sourced to another organization during down times;

  • a case when an audit observation creates a previously unrecognized revenue stream or eliminates a previously unidentified recurring cost stream. 

I am sure that there are other examples, but overall it is a very subjective determination.

Many businesses and organizations currently face decreased revenues resulting from COVID-19, efforts to keep employees on board, and covering fixed costs as we seek a new normal. Internal audit leaders must do their part in being cost-conscious. Typically the cost of resources, travel, and technology are the most considerable costs for internal audit functions.

Talent Optimization. Resources include both internal and external resources. One way to balance the cost of resources is to co-source with a partner so you can easily ramp up and ramp down as demand requires, keeping you from having less-than-optimized full-time equivalents (FTEs) on staff during slower periods. A co-source relationship also allows internal audit functions to bring in temporary subject matter expertise as needed for specialty and technical audits. 

Travel. This one is easy right now. The recent shutdowns, quarantines, and travel restrictions and bans have forced us all to rethink how to perform work remotely that we have typically performed onsite at other locations. Embracing technology has been thrust upon us, and creative means of getting work done have emerged. Refer to the section of this series on Innovation. Internal audit leaders have a decision to make. As we emerge from this pandemic and travel restrictions and bans are lifted, we must ask ourselves a question. Will travel for audit teams resume at pre-pandemic levels, or have leaders taken this time to reenvision and replaced time-wasting travel with innovative ways to perform the same procedures remotely through technological innovation? Don’t get us wrong, we miss airports, connections, delays, middle seats, hotel rooms, Ubers, and taxis as much as anyone else, right now.

Technology and subscription services. These should be assessed by internal audit function leadership as a means to reduce costs. Evaluation of the cost structure of the function is essential, including hidden costs and recurring subscription costs. Do not worry, we are not saying to cancel your subscription to Internal Auditor magazine. Some areas to look do include unused subscription services. Does the internal audit team still need a Unix sandbox server if the company has moved to a Linux platform? Do we need to be paying support on those 12 subscriptions to ACL if only three team members are primarily using Tableau for analytics? The key is to be a good steward of the organization’s funds while balancing effective audit processes. 

Service Driven – gone are the days when internal audit functions were the “corporate police.” We think, at least. For the past couple of decades, internal audit functions have been making the shift from this policing role to become a trusted advisor and business partner to the organization. A more recent trend is for internal audit functions to treat auditees (business units, departments, functions, etc.) as customers. By providing thorough audits completed in a timely manner, open lines of communication, value add recommendations, and minimal disruption, internal audit functions are treating auditees with the service levels typically reserved for customers. 

Some internal audit leaders now include auditees in the planning process to identify areas where they have pain points to help identify problem areas and provide recommendations to resolve the issue. By employing customer service based approaches and skills, internal audit functions are becoming trusted advisors and catalysts for change in organizations. These techniques include: 

  • rallying around the customer;

  • understanding the customer;

  • helping the customer in the way, they want to be helped;

  • solving for short and long term needs, and;

  • providing personalized solutions.

With all that said, internal audit functions still have standards to abide by and have a compliance role to play within the organization.  Not all observations will be rosy and value add. Not all reports will be issued with a smiley face on the cover page. There is a balance in being an effective internal audit function – regulations, assurance, guidelines, Board requirements, management needs, value add, building relationships, and being a trusted advisor.  Getting all of those right all the time is not always reality.  Focusing on being an effective partner to the organization with the proper balance brings one closer.

While not the flashiest or most appealing set of areas where internal audit functions can improve, this group of Effectiveness areas are some of the basic building blocks to being a good partner to the business. These basic blocking-and-tackling techniques, if implemented well, will aid internal audit functions in their pursuit of the other reenvisioning approaches.

Conclusion 

As we stand at the crossroads, or kitchen table, or home office, or corner of a bedroom, where ever the COVID-19 pandemic has left us, internal audit leaders must look forward to the new normal for the planet, governments, organizations, businesses, and internal audit functions alike. How do we determine what the future will hold? How will governments, organizations, and businesses pivot? How will internal audit functions pivot to follow suit? How can internal audit functions reemerge to be more effective and more efficient considering the challenges we face? How does internal audit continue to provide assurance, insight, and value to the business during these unusual times and beyond? These questions, and more, are being asked by business leaders, audit function leaders, and Boards globally.

This series has scraped the surface of options for internal audit functions to consider as they pontificate the future of internal audit. The right approach will vary based on audit function maturity, organization culture, resources, talent, technology, budget, industry, geography, and other prevailing factors. We have studied four different approaches to reenvisioning internal audit: Lean, Agile, Innovation, and Effectiveness. As audit leaders strive to bring continued effectiveness, value, and efficiency to their functions, we hope that this series of articles provides, at least, starting point for the journey to reenvisioning internal audit.

If you missed part one of this series, you can find it in our blog at Reenvisioning Part 1 

If you missed part two of this series, you can find it in our blog at Reenvisioning Part 2

If you missed part three of this series, you can find it in our blog at Reenvisioning Part 3

 

[i] Pages   - International Professional Practices Framework (IPPF) Pages   - International Professional Practices Framework (IPPF) . (2020). Retrieved 1 September 2020, from https://na.theiia.org/standards-guidance/Pages/Standards-and-Guidance-IPPF.aspx

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

 

Internal Audit InsightsJim CulbrethInternal Audit, EffectivenessComment