Work in progress
18 January 2019
Deloitte’s 2018 Global Chief Audit Executive research survey, The innovation imperative, Forging Internal Audit’s path to greater impact and influence, surveyed 1,100 internal audit leaders in 40 countries. This makes interesting reading to see what some of the high impact functions are doing with regards to agile methods and robotic process automation (RPA) for many repetitive tasks.
At the same time there is still work to be done by some internal audit functions to address key areas such as impact and influence. Only 40% of audit leaders believe they have a strong impact and influence, an improvement on the 2016 Deloitte survey (28%). There is lots that internal audit can and should be doing, starting with communication – talk to stakeholders, raise awareness of internal audit and show how they can help the organisation. I would also recommend include looking at how internal audit can develop and improve day-to-day working relationships. Other questions worth asking are: are stakeholders involved in the audit planning process to understand their concerns and key risks to the business?; and, is internal audit taking a strategic approach to evolve ahead of the wider organisation to ensure it can fulfil its purpose stay relevant and deliver insight?
Of those surveyed, 37% cite missing skills as presenting a key challenge which may be reflected in the resourcing mix of internal audit functions with the use of co sourcing (36%), occasional use of external resources (25%), guest auditors (19%) and outsourcing (19%). Through the rich source of external expertise utilised there is the opportunity for the in-house internal audit team to work with them, learn and build up their skills and knowledge. Also, through appraisal processes, is training and development identified and carried out to fill some of the missing skills gaps? What about the opportunity for secondments both into and out of internal audit to develop a wider perspective and greater understanding of the organisation, create a visible personal profile with the function/organisation and establish key contacts with senior managers and leaders?
Written reports are still the most favoured method of reporting, with nine in ten internal audit functions issuing a report and, of these, 29% are taking between one and three months to deliver. Without delving deeper into the reasons behind this, it raises the question as to the impact the report and any recommendations may have and does this reflect the initial question on the 40% that believe they have a strong impact and influence? Could it be the complexity of the subject matter or risk level that needs to be addressed, or does the answer lie in more basic reasons? At the same time is there on-going communication during the audit to ensure that advice and insight is provided ahead of the audit report?
Less than 30% of internal audit functions have evaluated their organisation’s culture in the last three years. Culture has been a hot topic over the past few years following a series of scandals and the desire to understand the underlying causes of corporate governance failures. Could it be down to the size of the audit team and the already demanding audit plan or even knowing where to start! An alternative to undertaking a specific audit in this area is building it into the scope of assurance and consultancy engagements as a matter of course – informal observations noted and followed up to seek further information or evidence – see our top tip on this.
One of the top key strategic priorities identified in the next 3-5 years is enhancing the quality of internal audit. Looking at continuous assurance and automation to achieve this is cited to improve efficiency and effectiveness as well as agile internal auditing. I would also include the requirements of the quality assurance and improvement programme in the IIA Standards (1300-1322) to monitor and identify improvements to the internal audit function.
A commitment to the continual review and improvement of the internal audit function is a vital aspect of earning and maintaining credibility, trust, impact and influence among stakeholders.
Further reading
1230 Continuous professional development
1300 – 1322 Quality Assurance
Raising the profile of internal audit
Future-proofing internal audit
Top tips: making culture part of your DNA
