Expect More From Internal Audit | Stephen Ducker |...

For 12 years, PwC has undertaken an annual ‘State of the Internal Audit Profession’ survey in which a consistent theme has been that Chief Audit Executives, Board Members and Executive Management, all expect IA to deliver more.

Looking back on over 20 years of work in internal audit in one form or another, I asked myself: “What does ‘Expect More’ really mean?”

Of course at the high level, it means Expect More...Value. Certainly, in many companies today, IA is unrecognisable from what it was when I started in the mid 1990s, when it was too often the proverbial ‘elephants' graveyard’, unwelcomed and poorly staffed. But there are still many companies that have low expectations of IA, and so the function still faces many of the same challenges.

Some IA teams have tried to demonstrate their value through a scorekeeping approach:

• How many audits?
• How many findings?
• How many recommendations?

While this kind of metric may have a place in a balanced scorecard, too much focus on such KPIs can lead to negative, confrontational ‘point scoring’ behaviours that undermine the potential of the function. Measuring the monetary value of savings is a big step forward, but also has its limitations: valuations can be highly subjective and not everything can be measured in monetary terms.

So what is the value that stakeholders should be expecting?

     *     *     *     *     *      *     *     *     *     *      *     *     *     *     *

Let’s start with the external perspective.

Expect More…Insight.

A good IA function should be a source of new knowledge for the business. They should be actively connected to external centres of excellence, professional and technical bodies, and bringing examples of best practice, warnings of emerging risks, as well as the latest developments in audit methodology and technology.

But IA can also bring greater understanding about their own organisation, particularly through tools or approaches such as process mapping, process mining and data analytics. I have seen many recent cases where analytics have revealed something about the business that was previously unknown to the company.

At an even simpler level, IA is often able to identify the sometimes significant gaps between what management thinks is happening, what the procedure manual says should be happening, and what is actually going on.

Expect More…Engagement.

When I first joined IA, it really didn’t feel like we were a part of the business at all. Avoided if possible, tolerated at best; the team didn’t even work in the same building as most of the major business units.

If IA wants to add value, it has be fully integrated within the organisational structure: invited to participate in key IT and other business projects; represented in discussions on business strategy; with meaningful access to senior management and the audit committee. And to do that, the auditors themselves have to have the experience, credibility and presence to operate at that level. Too often, I see name cards that say ‘Head of Internal Audit’ but in reality, the person in the role is still quite junior, with little industry knowledge. However good that person may be, it’s hard to operate at the level outlined above which is increasingly what stakeholders expect or ought to expect.

Expect More…Relevance

Internal audit is only adding value if it is auditing ‘stuff that matters’. Maybe that’s not a very technical term for ‘risk based auditing’, but it gets to the heart of the issue. Internal auditors have to keep constantly up to date with the business, with the risks faced, the technology being deployed, and the tools available to auditors. In a world of disruption, convergence, O2O, mega-trends, cybercrime and all the other buzz-words, internal audit has to be agile, and able to bring a whole range of skills and specialisms to remain relevant.

I used to think the greatest customer feedback you could get was being asked to come back and audit again, but recently I have a new contender for that prize: completing an analytics IA project, and being asked to help embed the tool in the business so that management can run those same analytics for themselves.

In my two years as a Head of IA, one of the key meetings of the year was when I got half an hour with the CEO to brief him on the key components of the IA plan for the coming year and get his approval. I always challenged myself:

“When he looks at the plan, will he immediately understand why each item is on it?”

If he needed to ask “What?” Or “Why?” then that probably meant that the item in question wasn’t actually that important. A good IA plan is aligned to the business strategy, addressing risks that matter to senior management.

      *     *     *     *     *      *     *     *     *     *      *     *     *     *     *

The second, internal, perspective is that of IA practitioners who are also key stakeholders, and they too should Expect More.

I had no idea what to expect when I started in IA, but I now often find myself coaching my own staff about their career choices, sometimes when they are trying to decide whether to leave the firm. (Yes, it does happen!)

Internal Audit has contributed many of the stepping stones in my career, and so I have no hesitation in recommending it as a career path, but only if the role in question meets certain important expectations.

Expect More…Diversity

Whether your interest is travel, working with different people, gaining experience of different businesses or parts of a business, or developing new technical skills, IA can provide them all. But make sure it’s a function that has all of these embedded in its remit.

Expect More…Career

Once seen as a dead end, IA can now lead to a long and senior career itself, or to many diverse careers within one or more businesses. A company that values IA, values its people. They invest in their training and development, give them the right tools to do their best work, and provide rewarding career paths for their future.

Expect More…Job Satisfaction

Motivation and engagement will naturally come if you work in an IA team that is valued, and adds value, in the ways set out above. Promotions and pay rises are on many people’s list of expectations of course, but so is knowing that what you are doing makes a difference.

      *     *     *     *     *      *     *     *     *     *      *     *     *     *     *

So in summary, while there are some great ‘IA shops’ out there, that fully embody all the values discussed, the message from stakeholders is clear: they expect more from IA, and as an IA professional, that sounds like an exciting invitation to step up and Deliver…More.

 

What are other areas where IA can do more? Share your thoughts below.