Having robust audit processes in place and very competent auditors is key for sustained success. Even when this is the case, demonstrating the value of an internal audit organization is however not an easy task. I have seen many leaders struggling with this. To be honest I tried hard myself with the notion during my professional career. Only using feedback from stakeholders is not enough.
Being able to demonstrate the return on investment is absolutely crucial and nowadays more important than ever. Failing to do so can have long-lasting damages including on the morale of audit professionals. It can eventually have a bad impact on the credibility of the internal audit organization or potentially worse, it can trigger questions on its reason to exist.
Internal auditing is sometimes only perceived as a function uncovering issues that are not having a negative impact so far, or even which potentially will never have one. Such a limited view makes it very difficult for stakeholders to understand the return on investment. The following 4 steps help internal audit organizations to reveal their value.
Understanding the big picture and aligning efforts
There is always the first step to take. Understanding the big picture is a pre-requisite. There is an absolute need for leaders of internal audit organizations to fully understand the company’s strategy, it’s processes, the challenges and the opportunities being faced, and the evolution of these. The internal audit function needs to put its efforts where things matter. Deploying resources in areas where the business strategies and processes are not supported would be a waste of energy. Not deploying audit resources where topics are strategically or operationally critical would be a mistake.
To illustrate this, a company active in the food and beverage business has an absolute necessity and a duty to keep its promise as it relates to food safety. It is then evident that the scope of internal auditing for such an enterprise has to encompass food safety. If the strategy of the same company is then moving towards additional efforts and requirements in the area of sustainability, it makes sense for the internal audit organization to consider enlarging its scope to cover the sustainability matters and standards also. This might seem obvious but having a mismatch between the internal audit activities and the company priorities is unfortunately not something exceptional.
If a company wants to improve in specific areas then for sure it has to consider the internal audit organization as a key element for doing so. The audit scope should then cover these areas adequately. With this in mind, grasping the company strategies to align the efforts should be a prerequisite for internal audit leaders. It will be up to them to understand where to put resources in a balanced way and spend them wisely. No alignment, then no value created nor perceived as a result.
Selecting the right metrics
A second step to take for an internal audit organization would be selecting the right metrics. The ones to measure, analyze and evaluate the performance so that ultimately, the processes and the entire internal audit organization can be improved, and the value provided to stakeholders maximized.
Selecting performance indicators related to audit processes (e.g., time to issue an audit report or calibration of auditors) is very important but the internal audit organization should not forget to select the ones that mirror the benefits provided to stakeholders and the business. Here again, an alignment between the metrics and what matters for the company is key for success. In our previous food and beverage company example, being able to link the reduction of recalls to the audits performed is a clear demonstration of the value of the internal audit organization.
Having fewer consumer complaints related to the quality of raw materials due to an effective supplier audit and development program is another demonstration of value and success. Expressing in a tangible way how the audit function contributes to risk reduction is key.
Going the extra mile
An internal audit organization could and should — in my opinion — go the extra mile, beyond its normal duties. Using the expertise of auditors to deliver training or participate in specific projects for the benefits of the company is a great example of providing additional value. I remember getting out of my audit function for several days to perform a post-launch review in collaboration with R&D. This has been a great personal experience and a value-adding one for the company. I was able to demonstrate that my skills and expertise could be valued in other areas than the typical audit program. I learned also a lot myself from the experience. As a result, the internal audit organization was perceived as a true partner going out of its normal duties for the benefit of the business. Typical other adding-value examples are using the expertise of auditors of the internal audit organization to provide training to the field or to participate in trouble-shooting projects. Going the extra mile is always remembered on all sides of the audit desk.
Communicating two-ways
It is of the utmost importance for the internal audit organization to keep track of its performance and accomplishments and to communicate regularly on them. Communicating them at the highest level helps and in my experience, is something internal audit organizations are not always very good at. Providing value is crucial but communicating on it, is equally important. Internal audit organizations may benefit from benchmarking with other departments that excel in doing so.
Asking for feedback from stakeholders is another key element for internal audit organizations. The information collected is always extremely useful, whether it is positive or negative. Involving stakeholders not only shows that their opinion matters but also it involves them in shaping, re-shaping and improving the way the internal audit organization operates and serves the business. Engaging stakeholders helps to get feedback for continuous improvement but is also an important way for the internal audit organization to convey the value it provides.
Understanding the big picture and aligning efforts, selecting the right metrics, going the extra-mile and two-ways communication is not rocket science but not taking one of the steps can prevent an internal audit organization to demonstrate its value to the full.
Doing a great internal audit job AND ticking all the four boxes helps.
By Marc Cwikowski
September 8, 2020
