Four steps to formalise internal audit’s strategic impact

Internal audit isn’t just about compliance anymore. Increasingly, the function’s role is being incorporated into the broader business strategy – from mulling over major capital projects to advising on mergers and acquisitions. But executives say they need to do a better job of formally describing the role internal auditors will play in charting the course of the business.

Three-quarters of executives surveyed by Ernst & Young said strong risk management has a positive impact on their long-term earnings performance. And internal auditors play a key part: An equal percentage said their internal audit function has a positive impact on their risk management efforts, according to the report, The Future of Internal Audit is Now, which polled 695 chief auditors and other C-suite executives. But 61% said they had no documented mandate aligning internal audit with the organisational strategy.

“The paradigm for internal audit’s role is shifting to a more holistic role, encompassing compliance, operational and strategic advising,” said Brian Schwartz, Ernst & Young’s internal audit leader in the Americas. “Today’s internal audit function must be aligned to the organisation’s strategic initiatives to be relevant. It is imperative that audit functions revisit their respective mandates and adjust their focus to include coverage of strategic and operational business risks, and not only financial compliance.”

The report recommends a four-step process for executives to follow in creating a formal strategy document for the internal audit function:

• Develop and refine internal audit’s strategic vision: Incorporate the needs of key stakeholders plus the roles and responsibilities of internal audit into a plan for what internal audit should accomplish over a long period.

• Identify and prioritise key strategic initiatives: Align initiatives to key business risks and key operational and functional priorities. Make sure internal audit has the staff, tools, processes and functional insights necessary to accomplish the objectives.

• Design key performance indicators: Determine metrics that will measure how internal audit fares in meeting its initiatives, aligning with stakeholder expectations and producing desired results.

• Develop an operating strategy: Describe activities that will help internal audit accomplish its objectives. Determine key milestones and how the function will communicate its progress to key stakeholders. Create a mechanism for internal audit to adapt to changing priorities so it can remain relevant.

The strategic plan can help internal audit develop and retain a key role in charting a successful path for an organisation. Schwartz said building a relationship of mutual trust with management also is critical in maximising internal audit’s relevance to stakeholders. He said internal audit functions can develop a “relationship map” that identifies key stakeholders and assigns specific internal audit leaders to “own” those relationships and interact with those stakeholders on a recurring basis.

“This includes formal meetings to discuss upcoming audits and casual contact to discuss changes to business objectives,” Schwartz said.

Prominent role in planning

Despite the lack of a documented mandate in many organisations, internal audit already is playing a prominent role in business planning. The areas where internal audit is contributing include major capital projects (identified by 49% of survey respondents), IT systems implementations (42%), mergers and acquisitions (37%) and material contracts (32%).

Schwartz said organisations can overlook the real value internal audit can provide. He said that when the function is set on a compliance path with little alignment to strategic priorities, management can overlook the contributions internal audit can make in creating organisational value. Internal auditors can even lose sight of this themselves, Schwartz said, when they focus strictly on compliance.

“Our survey points to the need for internal audit to step back from the audit plan and develop a strategic plan,” Schwartz said. “This is one way for internal audit to challenge the value it brings and its true alignment to the strategic priorities of the organisation.”

Additional CGMA resources:

• Top skills sought from new internal audit staff reflect new priorities: The most sought-after skills for new internal audit staff are changing to reflect new, more strategic priorities, a study shows. Skills such as analytical and critical thinking and communication have emerged as most important as chief audit executives explore ways to increase their value to organisations.

• Risk management provides new opportunities for internal auditors: Business leaders would like more substantial risk management input from internal auditors, a PwC survey shows. Although barriers can discourage internal auditors from increasing their influence, a growing number of business risks present an opportunity for them to add value.

• New skills, existing talent: Organisations are working to transform their finance functions to take a broader role in contributing to their organisation’s success. The transformation includes increased collaboration with the wider business to provide better and more insightful management information.

—Ken Tysiac (ktysiac@aicpa.org) is a CGMA Magazine senior editor.