High-performing audit teams
Jonathan Chapman has written another interesting piece for Wolters Kluwer.
High performing internal audit teams: Accountable and efficient makes several points with which I agree. But there are also some with which I disagree, and he has missed some that I believe are essential.
He identifies “four characteristics that in combination lead to the highest levels of performance.” They are:
- Ensure their activity is truly aligned with their organization and the value it is looking to create.
- Operate internal audit stakeholder relationship management – all of internal audit working together to the benefit of the entire range of internal audit stakeholders.
- Adopt an empowering leadership approach such that employees have the direction, support, and freedom to deliver at the highest standards.
- Operate in an accountable and efficient manner – clearly transparent in their performance and the work they are doing to continually improve.
The article referenced above is the last in a series that started with High performance internal audit teams: Business alignment. He makes some good points in the first piece, but fails to talk about enterprise risk-based auditing: focusing your audit plan on the more significant sources of risk to the organization and the achievement of its objectives.
I believe that to be a critical omission.
In his latest article, he says:
High performance internal audit teams look to deliver value beyond traditional audit work. Internal audit should be the catalyst for management action that makes the business more secure and sustainable by having a constant focus on control improvement.
I agree, subject to saying (again) that we should perform enterprise risk-based auditing. Deliver “the action” that is most valuable and relevant to the success of the company rather than tinkering around the edges.
Once we know what the more significant risks are we can think about what types of audit work should be performed (such as assurance vs. consulting), what tools and techniques to use, and which members of the extended audit team (i.e., including service providers and guest auditors) would be the best to deliver the value we seek, and how much budget (hours and dollars) should be allocated.
I like what he says here:
Internal audit functions that do … ‘flash’ audit work are typically not engaged for more than a week. Reporting is often verbal, supported by a one-page memo, and cleared through internal audit sign-offs. Executive leadership values this approach with its pace and immediacy, allowing for quick change in the business and immediate impact. In high performance internal audit functions, auditors also embrace this pace of delivery that focuses on smaller, more targeted scopes.
In this context, high performance internal audit functions will see traditional full-scope audits operating increasingly as a smaller proportion of the overall book of work, completed each year, with these being increasingly accompanied by all the above activities.
We need to seek to deliver the assurance, advice, and insight the organization needs, when it needs it, in an easily consumed and actionable way.
He also says (with my highlights):
High performance internal audit functions have a truly innovative mindset. All of us see in our work the pressure placed on our front-line colleagues to improve both the service or product they deliver with less headcount or overall lower budgets. Can we help them in this? We are in the privileged position of being able to spend time in all parts of our business, reviewing processes and practices and opining on their effectiveness from a control perspective. What would it take to extend this to also offer ideas and thoughts on areas in which they may improve their quality and/or efficiency? Perhaps drawing on the wider view we have around how other parts of the business are operating doing similar activities? Progressive internal audit functions identify simplification opportunities that they regularly share with the business. One high performing team has even gone as far as including a section on their audit report that identifies specific efficiency opportunities, thus encouraging auditors to consistently be on the lookout for additional opportunities as they conduct their work.
Please join me in telling every member of the IIA’s Standards Board that the insights we share with our leaders can be our most valuable product.
There is more to building and maintaining a world-class internal audit function.
In most of my companies, I was able to build a team of high-powered, smart, intelligent, curious, imaginative, dedicated, and business-focused auditors.
If you don’t have the right people, world-class people, and let them run free, you won’t have a world-class internal audit function.
I welcome your thoughts on comments. Jonathan has a lot to say that is worth considering. Agree?
Leave a comment
Norman Marks on Governance, Risk Management, and Internal Audit 
“One high performing team has even gone as far as including a section on their audit report that identifies specific efficiency opportunities, thus encouraging auditors to consistently be on the lookout for additional opportunities as they conduct their work.”
Amen to this. The business may already acknowledge these opportunities but were unable to proceed because of the initial up-font cost that their leaders may not want to approve. Showing their management these items on an audit report may give them a little leverage with management to implement.
Why aren’t we talking to that level of management ourselves?
The best principle that an internal auditor should always remember and hold high is by assuming as if s/he is the sole or majority owner of the business, how to navigate and prosper in a complex business environment, and continue in perpetuity even after retirement or due to unavoidable event that may render early cessation of ownership.