Based on your responses, here are key insights from leading Internal Audit functions, and guidance on where you can expect more from Internal Audit.
Leading Internal Audit has a strategic plan for its function. There is a clear understanding of the Internal Audit function’s mandate within the organisation and the strategic plan reflects that. The plan will define the nature of the investment in Internal Audit (resourcing model, budgeted spend, technology, focus etc) and how the return will be measured. The measures of Internal Audit’s success will include the contribution to organisational outcomes (value found, issues avoided, problems fixed, stakeholder satisfaction) rather than just inputs/outputs (reviews completed, issues found, process measures such as timeliness, quality compliance).
The next step is for the function to report on a value/outcomes basis. This could include identified benefits or value potential of the findings, and a summary of the results over the year against the strategic plan and the outcome measures agreed, within an Annual Internal Audit Report. These Annual Reports typically include themes and trends from across the organisation and how they relate to what is happening in the broader market, and provide a clear feedback loop on key enterprise risks.
Internal Audit plays a critical role in talent development within the organisation. This can include graduate rotation through the function, and also in developing rising talent through secondments into Internal Audit or as guest auditors to help broaden their perspective.
In an increasingly complex environment, Internal Audit functions need a broad range of skills and specialisms. Creating and sustaining this diversity can be challenging and leading Internal Audit functions are adopting a diverse range of resourcing models to ensure a quality audit and insights that management and boards value so highly.
In order to show the alignment of Internal Audit to strategy and risks, as well as the coordination with other sources of risk management and assurance, leading Internal Audit functions have a clear understanding and agreement of their role as the third line of defence. This understanding can be summarised in an assurance map within an Internal Audit Plan to help key stakeholders understand Internal Audit’s focus and priorities, and how this is part of the broader GRC ecosystem.
Risks come to life through behaviours. Leading functions are providing insights on the role of behaviours for issues identified, and whether behaviours are aligned to organisation values, risk appetite and culture. It may also be done in a more holistic way through an evaluation of the organisation’s risk culture; by considering the design and operation of key levers of culture and also a diagnostic and assessment of intended, expressed and actual behaviours.
Leading functions feature key Internal Audit leaders that relate and communicate effectively with the executive and board. They have strong influencing skills and can effectively manage differences of view and perspective to get a common understanding.
Leading functions have also changed the way they report. Great Internal Audit reporting is using fewer written words – it is now more concise, timely (real time, on line), interactive (workshop style, focused on optimising the agreed actions), and visual (leveraging visualisation techniques and report-on-a-page).
Leading functions critically evaluate their performance on an on-going basis, using both internal and external data sources. Tools to support this may include benchmarking against peers or professional standards. For example, members of the IIA are able to access comprehensive data on this globally.
But the greater impact of Internal Audit is on the whole organisation. Leading functions consider the cost and benefits of issues they find and management’s intended response. They also actively seek opportunities to assist management to optimise processes and controls, sometimes using skills from LEAN or SixSigma.
Leading Internal Audit leverages data as part of its planning, fieldwork and reporting. It works closely with technology and business intelligence functions in your organisation and uses a range of audit and analytic tools (and skills) to leverage both your data and external data sources for insight.
There are also a range of industry specific and core business process data analytic tools and techniques available that provide a highly cost effective way of conducting data analytics across entire datasets.
Leading Internal Audit shares potential solutions for the issues and opportunities it identifies and works with management to identify the optimal action. This doesn’t compromise Internal Audit’s objectivity – management ultimately decide the approach and implement it. Rather, management want to leverage the experience and insights Internal Audit has from beyond their organisation/ business unit, as they consider their best response to issues and opportunities identified.
Internal Audit is also using a range of working methods (such as Agile) and deliverables (such as daily/weekly verbal “Stand Ups”) tailored to management needs. This is particularly relevant on major transformation and IT projects, where Internal Audit conducts reviews throughout the project and gives its insights in time for management to change course if needed – including reviews in advance of key milestones.
Great Internal Audit functions continually seek to improve their contribution to an organisation and new ways of doing this – they actively self-disrupt to change for the better. Refer to PwC’s 19th annual CEO survey for the thoughts of New Zealand (and global) CEOs on innovation.
Progressive Internal Audit functions view External Quality Assessments (EQAs) as an opportunity to learn and potentially strengthen their functions, as opposed to a requirement of the IIA Standards. PwC’s Profiler tool allows you to assess your function against good practice.
Your responses indicate that Internal Audit is following best practice
To find out how strong Internal Audit Leaders guide their organisation, download your copy of PwC’s 2016 State of the Internal Audit Profession Study.