Impactful internal audit ?

A few months ago, in connection with information retrieval for my own dissertation, I found Deloitte 2018 global survey "The innovation imperative: Forging Internal Audit's path to greater impact and influence" which measured among others the current status and impact of the companies internal audit functions.

The survey shows that a good number of internal audit functions have made progress towards greater impact and influence within their organizations, while many others still struggle to do so. According to the survey, in many organizations the internal audit function has also not kept up with the business development.

I think the results obtained in Deloitte's survey are interesting, even though the survey does not meet the criteria for scientific research which is the point of view I am primarily interested in studying the functioning of internal audit. However, the survey made me think about what impact of the internal audit actually means in practice and how internal audit function could ensure the impactfulness of its operations in the future.

I start my reflection with the concept of impactfulness. The impactfulness of internal audit is generally considered to be something to aim for. However, the impactfulness of internal audit is challenging as a concept (as well as the added value concept I mentioned in my previous blog post). The Global Internal Audit Standards (later "the standards") form the central principles for the operation and implementation of internal auditing. The standards describe the measures that describe the nature and implementation of the internal audit, which form a reference framework supporting the implementation of the internal audit. The standards do not define the impactfulness of the internal audit or directly guide which measures the internal audit could use to be impactful.

The indeterminacy the concept of impactful of internal audit can become a challenge for internal audits although on the other hand it also gives the opportunity to interpret impactfulness at the company level and individually in such a way that it supports and provides guidelines for the implementation of internal audit and supports the impactfulness of its operations in exactly the desired way.

I have found that the impactfulness of internal audit can be defined in almost as many ways as there are auditors. Some think that by implementing the standards for internal auditing, the internal audit function is impactful. I think that it is safe to interpret impactfulness through the measures presented in the standards. However, simply implementing things does not mean that the measures bring about change and have an impact. In order to achieve impactfulness, the measures must among others include high quality in terms of content and they must be completed in a timely manner.

Interpreting the impact of internal audit through standards seems a bit complicated to me, and therefore I feel the need to further simplify the concept of impactfulness. My perception of impactfulness of the internal audit is simply that the internal audit is impactful when it detects and prevents the realization of risks which, if realized, would cause substantial harm to the company. The internal audit is also impactful when it has been able to verify that things really are as good as they are thought to be in the organization. I also like the idea that the impactfulness of internal audit is the result of high-quality audit activities. As long as the impactfulness of internal audit is not defined, I don't think there is a right or wrong way how the concept should be defined.

What measures can the internal audit then use to ensure the impactfulness of its operations? According to Deloitte, internal audit can improve and strengthen its operations inter alia by firstly, implementing internal audit analytics, secondly, strengthening the talent pipeline and making internal audit a magnet for talent, and thirdly, enhancing partnerships with the business and the quality of internal audit.

My own observations about the impactfulness of the internal audit are in line with the results obtained in Deloitte's survey. I think that the impactfulness of the internal audit is mainly influenced by the risk-based annual plan and the audit plan of the individual audit, the utilization of audit methodology and analytics, and the expertise of the internal auditors. I'll briefly discuss them next.

In my view the risk-based annual plan is the most central element of the impactful of internal audit. An impactful risk-based annual plan is based on a successful annual planning process. In order for the annual planning process to be successful in turn, the internal audit must be able to among others to create an open interaction with the company's key personnel and management to obtain key information during the process. Uncomplicated collaboration with the different lines of defense (compliance and risk management) is also key, as they complement the general understanding of the operating environment and business risks from their own perspectives. If the internal audit does not successfully focus on the organization's most critical risks, obtain up-to-date and correct information about the company's operating environment, or is able to assess which risks may become critical risks in the future as well, it will hardly be a surprise to anyone if the internal audit's operations are not impactful. Impactful, risk-based annual plan also takes into account Cyber ​​and ESG risks which have previously been seen more as possible risks rather than obvious ones.

An impactful internal audit engagement is based on a risk-based audit plan. According to my own experience, the audit plan is a living document. There are many reasons for that. One reason is that when the audit begins, the internal audit does not have all the information available. As the level of information increases, internal audit's vision and understanding of the audit target also improves. I think that changes to and evolving auditing plan is more the rule than the exception for impacful audit work.

Multiple studies have found that internal audit groups that adopted innovative approaches and methods tend to have greater impact and influence than those that do not. With the help of advanced audit methodology and analytics, the internal audit can deepen the audits but also narrow down the areas of audit justifiably. With the help of analytics, internal audit can among others have the opportunity to produce new information for the organization or bring additional information about already identified issues independently. Impactful, right?

If one wants internal audit to keep pace with business development and function impacful, it is justified to increase the use of analytics and experimentation with innovations. The essential thing is that things are not made too complicated. In the simplest terms, the use of analytics in audit work means, according to my own interpretation, the analysis of ready-made information produced by the business but it can also mean extensive internal audit database extraction and analysis with a separate tool, which takes a lot of time from the internal audit, requires separate expertise and possibly even additional resources. In my opinion, the most important thing in using analytics and trying out innovations is that their creation is based on a real, identified need, and the conclusion formed as a result of the operation can really generate added value for both business and audit. I dare say that this does not always happen.

Internal audit is only as impactful as the internal auditors are. If the internal auditors' business expertise has significant deficiencies, and they do understand only the internal audit expertise but not the needs of the business, it is possible that the internal audit is not considered credible in its role in the organization, in which case real interaction with business representatives is not formed. In this case the impactfulness of the internal audit will also be low. If the internal audit function wants to be profiled in the organization in the role of a so-called Trusted Advisor (which according to some interpretations is considered the central manifestation of an impacful internal audit), it is a vital condition for the internal audit to be able to identify deficiencies related to competence honestly and predictably as part of the audit annual planning, audit engagements and supplement expertise from external service providers as needed.